Live › vulnerability › CVE-2026-113496
Go to dashboardWhen saving VNC console settings, cockpit-machines passes the configured password as a command-line argument to a system utility. A local user on a host that allows cross-user process inspection can read that password from the process list and use it to reach the guest VM's graphical console.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running cockpit-machines to manage virtual machines with VNC console passwords set, where other local users can list processes of other users. Hosts that do not use VNC console passwords, or that restrict process visibility (for example with hidepid on procfs), are less exposed. The sources do not name fixed versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.
This page as .md · .json · in your agent: get_signal("CVE-2026-113496")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.