Cockpit: Local privilege escalation via symlink handling in SSH key helper
Summary
A flaw in the ssh-add-public-key.sh helper of Cockpit, the web-based server administration tool, allows a local authenticated user to escalate privileges. An attacker who controls the home directory of a target account can use symlinks in the .ssh or authorized_keys paths to make the helper change ownership and modes of arbitrary files when it runs with elevated privileges. The attack requires a privileged Cockpit session and user interaction, so it is not remotely exploitable.
Affected
- Red Hat Enterprise Linux 7, 8, 9 and 10 (Red Hat status: affected, no fixed build listed in the sources)
- Red Hat OpenShift Dev Spaces (Red Hat status: affected)
- Upstream Cockpit versions: Unknown.
Fixed in
- Upstream Cockpit 372 (published 10 Nov 2026) contains the fix.
- RHEL and OpenShift Dev Spaces fixed package versions: Unknown.
- Repology snapshots showed Cockpit 370 in CentOS Stream 10 and Fedora 44 updates; no evidence that these include 372.
Workaround
- No vendor workaround found.
- Interim measures (own recommendations, not vendor guidance): limit which local accounts can log into Cockpit and audit the .ssh directories and authorized_keys files of Cockpit-managed users for unexpected symlinks.
Exploitation
- No public proof of concept found.
- No evidence of exploitation in the wild found; CISA KEV not checked.
- Requires a local authenticated account, control over the target account's home directory, and a privileged Cockpit session.
Our recommendation
- Update Cockpit to version 372 or the fixed vendor package as soon as it is available for your distribution.
- Check the installed Cockpit version on all hosts and prioritise hosts that are reachable from the internet, because the same release also fixes the remote vulnerability CVE-2026-91150.
- Limit local accounts and Cockpit access to required users, and audit .ssh and authorized_keys files for unexpected symlinks.
- Priority: medium for SMEs; higher on multi-user Linux hosts or shared jump servers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-91151 access.redhat.com
- Red Hat Bugzilla 2478404 bugzilla.redhat.com
- Cockpit fix commit 4796b28 github.com
- Cockpit release 372 github.com
- Cockpit pull request 23921 github.com
- VulDB entry 435970 vuldb.com
- Repology Cockpit package versions repology.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:22.
Original description (NVD)
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
NVD references (10)
- https://access.redhat.com/errata/RHSA-2026:99599
- https://access.redhat.com/errata/RHSA-2026:99600
- https://access.redhat.com/errata/RHSA-2026:99601
- https://access.redhat.com/errata/RHSA-2026:99602
- https://access.redhat.com/errata/RHSA-2026:99603
- https://access.redhat.com/security/cve/CVE-2026-91151
- https://bugzilla.redhat.com/show_bug.cgi?id=2478404
- https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23
- https://github.com/cockpit-project/cockpit/releases/tag/372
- https://bugzilla.redhat.com/show_bug.cgi?id=2478404
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.