{"id":"CVE-2026-125672","kind":"vulnerability","aliases":["CVE-2026-125672"],"related":[],"title":"Cockpit storage: crafted LUKS header injects curl options into Tang settings","description":"A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.","summary":"Cockpit's storage module passes a Tang keyserver address from a LUKS/clevis header to curl without a separator, so an address starting with a dash is read as a curl option. An attacker who can attach a crafted encrypted device can get an admin user to trigger arbitrary file read or write as that Cockpit session user.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cockpit-storaged","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["clevis","cockpit","cockpit-storaged","linux","luks","other","tang"],"not_affected_if":["no-clevis-luks","no-cockpit-storaged"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:22:03+00:00","updated_at":"2026-11-10T11:22:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T11:22:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Cockpit storage: crafted LUKS header injects curl options into Tang settings","impact":"medium","summary":"Cockpit's storage module passes a Tang keyserver address from a LUKS/clevis header to curl without a separator, so an address starting with a dash is read as a curl option. An attacker who can attach a crafted encrypted device can get an admin user to trigger arbitrary file read or write as that Cockpit session user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cockpit","cockpit-storaged","linux","luks","clevis","tang"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"arbitrary file read or write as the Cockpit session user","analyst_note":"Confirm affected and fixed cockpit-storaged versions from the NVD entry or the upstream Cockpit advisory; the sources given name no versions.","how_to_check":"unknown","plain_action":"","product_name":"cockpit-storaged","needs_analyst":true,"not_affected_if":["no-cockpit-storaged","no-clevis-luks"],"who_is_affected":"Systems running Cockpit with the storage module (cockpit-storaged) that manage LUKS devices with Tang/clevis bindings. The exposure needs a crafted device to be attached and an administrator to edit its Tang settings in the Cockpit UI. Hosts without cockpit-storaged or without clevis-bound LUKS devices can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4635,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125672':14A,17A '-2026':13A,16A 'activ':152C 'address':38B,50B,98C,119C 'admin':73B 'administr':162C 'administratively-privileg':161C 'allow':133C 'arbitrari':77B,183C 'argument':113C 'attach':65B,138C 'attack':62B,135C 'begin':120C 'block':142C 'clevi':21B,102C 'cockpit':1A,19A,22B,24B,30B,84B,93C,164C,190C 'cockpit-storag':23B,92C 'cockpit-storaged':18A 'concaten':109C 'consol':153C 'craft':3A,67B,140C 'curl':7A,44B,59B,111C,125C,168C 'cve':12A,15A 'dash':54B 'desktop':155C 'devic':69B,143C,174C 'edit':172C 'encrypt':68B 'exampl':145C 'file':78B,184C 'flaw':88C 'found':90C 'get':71B 'header':5A,42B,107C 'hostnam':132C 'inject':6A,170C 'instead':129C 'keyserv':37B,97C,177C 'lead':181C 'linux':26B 'local':147C 'login':156C 'luk':4A,27B,106C 'luks/clevis':41B,141C 'modul':33B 'option':8A,60B,128C,169C 'pars':123C 'pass':34B 'privileg':163C 'read':56B,79B,99C,185C 'separ':47B,117C 'session':85B,157C,191C 'set':11A,178C 'start':51B 'storag':2A,25B,32B,94C 'storaged':20A 'tang':10A,29B,36B,96C,176C 'token':103C 'trigger':76B,167C 'unknow':166C 'unprivileg':148C 'user':74B,86B,149C,165C,192C 'vector':114C 'without':45B,115C 'write':81B,187C","nicknames":[],"mitigations":[],"who_affected":"Systems running Cockpit with the storage module (cockpit-storaged) that manage LUKS devices with Tang/clevis bindings. The exposure needs a crafted device to be attached and an administrator to edit its Tang settings in the Cockpit UI. Hosts without cockpit-storaged or without clevis-bound LUKS devices can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cockpitstoraged"],"ptokens":["cockpit","storaged"],"labels":["clevis","cockpit","cockpitstoraged","linux","luks","medium","other","tang","vendor"],"campaign_type":null,"search_a":"'-125672':14A,17A '-2026':13A,16A 'cockpit':1A,19A 'cockpit-storaged':18A 'craft':3A 'curl':7A 'cve':12A,15A 'header':5A 'inject':6A 'luk':4A 'option':8A 'set':11A 'storag':2A 'storaged':20A 'tang':10A","search_b":"'address':38B,50B 'admin':73B 'arbitrari':77B 'attach':65B 'attack':62B 'clevi':21B 'cockpit':22B,24B,30B,84B 'cockpit-storag':23B 'craft':67B 'curl':44B,59B 'dash':54B 'devic':69B 'encrypt':68B 'file':78B 'get':71B 'header':42B 'keyserv':37B 'linux':26B 'luk':27B 'luks/clevis':41B 'modul':33B 'option':60B 'pass':34B 'read':56B,79B 'separ':47B 'session':85B 'start':51B 'storag':25B,32B 'tang':29B,36B 'trigger':76B 'user':74B,86B 'without':45B 'write':81B","search_c":"'activ':152C 'address':98C,119C 'administr':162C 'administratively-privileg':161C 'allow':133C 'arbitrari':183C 'argument':113C 'attach':138C 'attack':135C 'begin':120C 'block':142C 'clevi':102C 'cockpit':93C,164C,190C 'cockpit-storag':92C 'concaten':109C 'consol':153C 'craft':140C 'curl':111C,125C,168C 'desktop':155C 'devic':143C,174C 'edit':172C 'exampl':145C 'file':184C 'flaw':88C 'found':90C 'header':107C 'hostnam':132C 'inject':170C 'instead':129C 'keyserv':97C,177C 'lead':181C 'local':147C 'login':156C 'luk':106C 'luks/clevis':141C 'option':128C,169C 'pars':123C 'privileg':163C 'read':99C,185C 'separ':117C 'session':157C,191C 'set':178C 'storag':94C 'tang':96C,176C 'token':103C 'trigger':167C 'unknow':166C 'unprivileg':148C 'user':149C,165C,192C 'vector':114C 'without':115C 'write':187C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T11:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125672","severity":null,"published_at":"2026-11-10T11:16:43+00:00","modified_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}