{"id":"CVE-2026-91151","kind":"vulnerability","aliases":["CVE-2026-91151"],"related":[],"title":"Cockpit: local user can change file ownership and gain root","description":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.","summary":"A flaw in the ssh-add-public-key.sh helper of Cockpit lets a local, logged-in user trick the privileged helper into following attacker-controlled symlinks in a target account's .ssh directory or authorized_keys file. An attacker can use this to change file ownership and modes, which can lead to local privilege escalation.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cockpit","fixed":["372"],"affected":"< 372 (lower bound unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["cockpit","infrastructure","linux","local-privilege-escalation","self-hosted"],"not_affected_if":["cockpit-not-installed","no-cockpit-installed","no-local-untrusted-users"],"how_to_check":"Run 'cockpit-bridge --version' or your package manager query (rpm -q cockpit-system / dpkg -l cockpit-system); versions below 372 lack the fix. Lower affected bound is not stated by the sources. Only matters if the cockpit users page is installed (pkg/users/ssh-add-public-key.sh).","fix":"Upgrade Cockpit to 372 or later (or your distro's backport of commit 4796b28).","status":"open","published_at":"2026-11-11T20:17:10+00:00","first_seen_at":"2026-11-11T20:28:53+00:00","triaged_at":"2026-11-11T20:30:13+00:00","updated_at":"2026-11-11T20:31:24+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T20:30:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Cockpit: local user can change file ownership and gain root","impact":"high","summary":"A flaw in the ssh-add-public-key.sh helper of Cockpit lets a local, logged-in user trick the privileged helper into following attacker-controlled symlinks in a target account's .ssh directory or authorized_keys file. An attacker can use this to change file ownership and modes, which can lead to local privilege escalation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cockpit","linux","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains elevated privileges on the server","analyst_note":"Confirm affected and fixed Cockpit versions and the patch URL from the NVD entry and the linked github.com patch and release notes.","how_to_check":"- Check the installed Cockpit version against the fixed version in the vendor release notes (`cockpit --version` or the package manager's version query, unknown if the sources do not give the exact command)\n- Confirm whether the `ssh-add-public-key.sh` helper is present on the host (unknown if the sources do not give a path)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-cockpit-installed","no-local-untrusted-users"],"who_is_affected":"Servers where Cockpit is installed and where local users have accounts, since the attacker must already be authenticated on the machine and control a target account's home directory. Systems with no Cockpit install or with no untrusted local accounts are less exposed. The sources do not give the affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4630,"output_tokens":596,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected and fixed Cockpit versions and the patch URL from the NVD entry and the linked github.com patch and release notes.","search":"'-2026':12A,15A '-91151':13A,16A 'account':56B,97C 'allow':137C 'arbitrarili':141C 'attack':50B,65B,126C,139C 'attacker-control':49B,125C 'authent':90C 'author':61B,133C 'avail':159C 'chang':5A,70B,142C 'cockpit':1A,17A,18B,35B,87C 'confidenti':157C 'control':51B,93C,127C 'cve':11A,14A 'derefer':106C 'directori':59B,100C 'elev':117C 'escal':24B,81B,152C 'exploit':102C 'file':6A,63B,71B,143C 'flaw':29B,83C 'follow':48B,124C 'found':85C 'gain':9A 'helper':33B,46B,111C,114C 'home':99C 'host':27B 'impact':154C 'infrastructur':19B 'integr':156C 'key':62B,134C 'lead':77B,148C 'let':36B 'linux':20B 'local':2A,22B,38B,79B,89C,150C 'local-privilege-escal':21B 'log':40B 'logged-in':39B 'mode':74B,146C 'ownership':7A,72B,144C 'path':135C 'potenti':147C 'privileg':23B,45B,80B,104C,118C,151C 'root':10A 'run':115C 'self':26B 'self-host':25B 'ssh':58B,131C 'ssh-add-public-key.sh':32B,110C 'symlink':52B,105C,128C 'system':162C 'target':55B,96C 'trick':43B,122C 'use':67B 'user':3A,42B,91C 'vulner':107C 'within':129C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts running Cockpit (the users/accounts page) where untrusted local users have logins. A local user can plant symlinks in .ssh or authorized_keys and make the privileged helper change file ownership or modes, which can lead to root. Hosts without Cockpit, or with no untrusted local users, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T20:31:24Z","by":"analyst","doc":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23","run_id":3592}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cockpit"],"ptokens":["cockpit"],"labels":["cockpit","high","infrastructure","linux","localprivilegeescalation","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-91151':13A,16A 'chang':5A 'cockpit':1A,17A 'cve':11A,14A 'file':6A 'gain':9A 'local':2A 'ownership':7A 'root':10A 'user':3A","search_b":"'account':56B 'attack':50B,65B 'attacker-control':49B 'author':61B 'chang':70B 'cockpit':18B,35B 'control':51B 'directori':59B 'escal':24B,81B 'file':63B,71B 'flaw':29B 'follow':48B 'helper':33B,46B 'host':27B 'infrastructur':19B 'key':62B 'lead':77B 'let':36B 'linux':20B 'local':22B,38B,79B 'local-privilege-escal':21B 'log':40B 'logged-in':39B 'mode':74B 'ownership':72B 'privileg':23B,45B,80B 'self':26B 'self-host':25B 'ssh':58B 'ssh-add-public-key.sh':32B 'symlink':52B 'target':55B 'trick':43B 'use':67B 'user':42B","search_c":"'account':97C 'allow':137C 'arbitrarili':141C 'attack':126C,139C 'attacker-control':125C 'authent':90C 'author':133C 'avail':159C 'chang':142C 'cockpit':87C 'confidenti':157C 'control':93C,127C 'derefer':106C 'directori':100C 'elev':117C 'escal':152C 'exploit':102C 'file':143C 'flaw':83C 'follow':124C 'found':85C 'helper':111C,114C 'home':99C 'impact':154C 'integr':156C 'key':134C 'lead':148C 'local':89C,150C 'mode':146C 'ownership':144C 'path':135C 'potenti':147C 'privileg':104C,118C,151C 'run':115C 'ssh':131C 'ssh-add-public-key.sh':110C 'symlink':105C,128C 'system':162C 'target':96C 'trick':122C 'user':91C 'vulner':107C 'within':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91151","severity":null,"published_at":"2026-11-11T20:17:10+00:00","modified_at":"2026-11-11T20:17:10+00:00","first_seen_at":"2026-11-11T20:28:53+00:00","fetched_at":"2026-11-11T20:28:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91151:3592","url":null,"severity":null,"published_at":"2026-11-11T20:31:24+00:00","modified_at":"2026-11-11T20:31:24+00:00","first_seen_at":"2026-11-11T20:31:24+00:00","fetched_at":"2026-11-11T20:31:24+00:00","note":"Cockpit 372 release notes list CVE-2026-91151; commit 4796b28 makes ssh-add-public-key.sh run as the user and stops it changing ownership through symlinks. Affected lower bound and exploitation not stated in sources; NVD page returned nothing."}],"documents":[{"id":128568,"url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128169,"url":"https://github.com/cockpit-project/cockpit/releases/tag/372","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}