CVE-2026-125672: Cockpit-storaged curl option injection via Tang keyserver

CVE-2026-125672 · Severity: medium · CVSS 6.6 · Published 2026-11-10

Cockpit-storaged is a storage management module for Cockpit, a web-based server management interface. A flaw in how it handles Tang keyserver addresses from LUKS device configurations allows an attacker with local console access to inject malicious options into curl commands executed by an administrator. An attacker can craft a block device that causes curl to read or write arbitrary files with administrator privileges.

Vendors: Red Hat.

Quick answers

Is CVE-2026-125672 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-125672 being exploited in the wild.
How severe is CVE-2026-125672?
Medium severity, with a CVSS score of 6.6, published 10 November 2026.
Which products and versions are affected?
Red Hat cockpit-storaged.
Is there a fix for CVE-2026-125672?
No fixed version is recorded yet. As a partial mitigation, restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and verify the Keyserver address shown in the "Edit Tang keyserver" dialog before clicking Save—reject values that do not resemble well-formed hostnames (e.g., those starting with a hyphen). If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125672 attacked?
It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-125672?
Check whether you run Red Hat Cockpit-Storaged. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

As a partial mitigation, restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and verify the Keyserver address shown in the "Edit Tang keyserver" dialog before clicking Save—reject values that do not resemble well-formed hostnames (e.g., those starting with a hyphen).

Technical details

A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator, allowing addresses beginning with "-" to be parsed as curl options instead of hostnames (CWE-88: argument delimiter injection). An attacker with local unprivileged console or desktop login can attach a crafted LUKS/clevis device and trick an administratively-privileged Cockpit user into editing the Tang keyserver settings and saving the malformed value, resulting in arbitrary file read/write as the Cockpit session user.

Affected products

  • Red Hat cockpit-storaged

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.