COCKPIT · CVE-2026-91151 · Infrastructure
FIX → 372 ✓ verified
A flaw in the ssh-add-public-key.sh helper of Cockpit lets a local, logged-in user trick the privileged helper into following attacker-controlled symlinks in a target account's .ssh directory or authorized_keys file. An attacker can use this to change file ownership and modes, which can lead to local privilege escalation.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Linux hosts running Cockpit (the users/accounts page) where untrusted local users have logins. A local user can plant symlinks in .ssh or authorized_keys and make the privileged helper change file ownership or modes, which can lead to root. Hosts without Cockpit, or with no untrusted local users, can skip it.
Not affected if cockpit-not-installed, no-cockpit-installed, no-local-untrusted-users
Who cares cockpit, linux, local-privilege-escalation, self-hosted
cockpit-bridge --version or your package manager query (rpm -q cockpit-system / dpkg -l cockpit-system); versions below 372 lack the fixUpgrade to 372
Upgrade Cockpit to 372 or later (or your distro's backport of commit 4796b28).
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.