CVE-2026-113496
Received Received - Intake

Password Disclosure in Cockpit-Machines via VNC Settings

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: redhat-SADP

Description
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113496
EUVD
EUVD-2026-104960

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-214 A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113496 is a flaw in cockpit-machines where VNC console passwords are exposed as command-line arguments when saving settings. A local attacker could read these passwords from the process list while another user modifies settings, potentially gaining unauthorized access to the guest VM's graphical console.

Detection Guidance

Check running processes for virt-xml commands containing VNC passwords. Use 'ps aux | grep virt-xml' to inspect command-line arguments. Look for processes with --graphics arguments that may expose passwords. Monitor system logs for cockpit-machines related activities during VNC console setting changes.

Impact Analysis

If exploited, this vulnerability allows an attacker to obtain VNC console passwords, which could lead to unauthorized access to virtual machines. Attackers might then control guest systems, steal data, or perform malicious actions depending on the VM's configuration and access.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive data, such as GDPR (data confidentiality) or HIPAA (patient data security). Unauthorized access to VMs may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Avoid using VNC console passwords until a fix is available. Restrict local user access to process inspection tools like ps. Disable cross-user process inspection if possible. Monitor guest VMs for unauthorized access attempts. Consider using alternative remote access methods that do not expose credentials in process lists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart