CVE-2026-113495
Received Received - Intake

Authentication Token Exposure in Cockpit-Machines via Command-Line Arguments

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: redhat-SADP

Description
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113495
EUVD
EUVD-2026-104959

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-214 A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves cockpit-machines passing Red Hat Subscription Management (RHSM) authentication tokens as command-line arguments to background helper processes during image retrieval. A local unprivileged attacker with cross-user process inspection capabilities can view these tokens while the process is active, leading to potential information disclosure.

Detection Guidance

Monitor active processes for command-line arguments containing RHSM tokens during image retrieval. Use tools like ps, top, or auditd to inspect running processes for exposed tokens. Check cockpit-machines logs for image download operations.

Impact Analysis

An attacker could exploit this flaw to read RHSM tokens, gaining unauthorized access to RHSM resources within the token's validity period. This may allow them to manage subscriptions or use services tied to the token without permission.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or systems, potentially violating compliance requirements like GDPR (data protection) or HIPAA (health information privacy) by exposing authentication tokens that grant access to restricted resources.

Mitigation Strategies

Disable cross-user process inspection capabilities on affected systems. Restrict local user access to process listings. Avoid using RHSM-backed image retrieval until a patch is available. Monitor network traffic for unauthorized RHSM resource access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart