{"id":"CVE-2026-113496","kind":"vulnerability","aliases":["CVE-2026-113496"],"related":[],"title":"cockpit-machines: VNC console password visible in process list","description":"A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.","summary":"When saving VNC console settings, cockpit-machines passes the configured password as a command-line argument to a system utility. A local user on a host that allows cross-user process inspection can read that password from the process list and use it to reach the guest VM's graphical console.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cockpit","cockpit-machines","libvirt","linux","package","self-hosted"],"not_affected_if":["no-vnc-password","process-visibility-restricted"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T12:17:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:30:43+00:00","updated_at":"2026-10-25T04:30:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:30:43Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"cockpit-machines: VNC console password visible in process list","impact":"medium","summary":"When saving VNC console settings, cockpit-machines passes the configured password as a command-line argument to a system utility. A local user on a host that allows cross-user process inspection can read that password from the process list and use it to reach the guest VM's graphical console.","category":"package","nicknames":[],"who_cares":["cockpit-machines","cockpit","libvirt","linux","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user reads VNC password and opens guest VM console","analyst_note":"Find the fixed cockpit-machines version and the affected version range in the NVD entry or upstream commit, and confirm which utility receives the password.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-vnc-password","process-visibility-restricted"],"who_is_affected":"Hosts running cockpit-machines to manage virtual machines with VNC console passwords set, where other local users can list processes of other users. Hosts that do not use VNC console passwords, or that restrict process visibility (for example with hidepid on procfs), are less exposed. The sources do not name fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000566,"input_tokens":3330,"output_tokens":467,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113496':13A,16A '-2026':12A,15A 'access':148C 'allow':56B,122C,146C 'anoth':138C 'argument':44B,108C 'attack':117C 'cockpit':2A,17B,19B,33B,87C 'cockpit-machin':1A,18B,32B,86C 'command':42B,106C 'command-lin':41B,105C 'comput':93C 'configur':37B,98C 'consol':5A,30B,80B,95C,156C 'could':128C 'credenti':143C 'cross':58B,124C 'cross-us':57B,123C 'cve':11A,14A 'direct':102C 'disclosur':144C 'expos':131C 'flaw':82C 'found':84C 'graphic':79B,155C 'guest':76B,151C 'host':26B,54B,120C 'inspect':61B,127C 'libvirt':21B 'line':43B,107C 'linux':22B 'list':10A,69B,136C 'local':50B,115C 'machin':3A,20B,34B,88C,153C 'modifi':140C 'network':92C 'packag':23B 'pass':35B,101C 'password':6A,38B,65B,99C,132C 'process':9A,60B,68B,126C,135C 'reach':74B 'read':63B,129C 'save':28B,90C 'self':25B 'self-host':24B 'set':31B,96C,141C 'system':47B,112C 'unauthor':147C 'under':111C 'unprivileg':116C 'use':71B 'user':51B,59B,125C,139C 'util':48B,113C 'virtual':91C,152C 'visibl':7A 'vm':77B 'vnc':4A,29B,94C","nicknames":[],"mitigations":[],"who_affected":"Hosts running cockpit-machines to manage virtual machines with VNC console passwords set, where other local users can list processes of other users. Hosts that do not use VNC console passwords, or that restrict process visibility (for example with hidepid on procfs), are less exposed. The sources do not name fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113496","severity":null,"published_at":"2026-10-20T12:17:29+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}