---
id: CVE-2026-4631
title: >-
  Cockpit's remote login feature passes user-supplied hostnames and usernames
  from the web interface to the SSH client without validation or sanitization
summary: >-
  Cockpit's remote login feature passes user-supplied hostnames and usernames
  from the web interface to the SSH client without validation or sanitization.
  An attacker with network access to the Cockpit web service can craft a single
  HTTP r…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
  - CWE-78
published: '2026-04-07'
updated: '2026-06-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4631'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:7381'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:7382'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:7383'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:7384'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-4631'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2450246'
    label: secalert@redhat.com
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/10/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2026:7381'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7382'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7383'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7384'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-4631'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2450246'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4631.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - exploit-available
epss: 0.09216
epssPercentile: 0.95165
exploitAvailable: true
ingestedAt: '2026-06-29T13:24:34.821Z'
exploits:
  exploitdb: true
  github: 2
  githubRepos:
    - 'https://github.com/cyberheartmi9/CVE-2026-4631-cockpit-RCE'
    - 'https://github.com/ExDev994/CVE-2026-4631-cockpit-RCE'
  nuclei:
    - CVE-2026-4631
  checkedAt: '2026-09-25T08:20:58.480Z'
---

## Overview

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.