Is CVE-2026-4802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4802 being exploited in the wild.

How severe is CVE-2026-4802?

High severity, with a CVSS score of 8, published 11 May 2026.

Which products and versions are affected?

Cockpit Project Cockpit Before 362, unspecified.

Is there a fix for CVE-2026-4802?

A patch was published on 2026-05-20: Public disclosure of fix in Cockpit 362 and technical details on oss-security Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4802 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-4802?

Check whether you run Cockpit Project Cockpit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4802: Cockpit command injection in system logs UI

CVE-2026-4802 · Severity: high · CVSS 8 · Published 2026-05-11

Cockpit is a web-based interface used to manage and monitor Linux servers. A security flaw in its system logs component allows an attacker to execute malicious commands on the server if a logged-in administrator clicks on a specially crafted link. This could lead to a full takeover of the server, unauthorized data access, or service disruption.

Technologies: Cockpit Project Cockpit. Vendors: Cockpit Project.

Quick answers

Is CVE-2026-4802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4802 being exploited in the wild.
How severe is CVE-2026-4802?: High severity, with a CVSS score of 8, published 11 May 2026.
Which products and versions are affected?: Cockpit Project Cockpit Before 362, unspecified.
Is there a fix for CVE-2026-4802?: A patch was published on 2026-05-20: Public disclosure of fix in Cockpit 362 and technical details on oss-security Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4802 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-4802?: Check whether you run Cockpit Project Cockpit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Cockpit's system logs UI, specifically within the 'loadServiceFilters()' path in 'pkg/systemd/logsJournal.jsx'. The application constructs shell commands by joining array elements into a string with insufficient sanitization before executing them via '/bin/bash -ec'. An attacker can provide malicious input through URL parameters (such as 'since' or 'boot') containing shell metacharacters or command substitutions (e.g., '$(...)'). Exploitation requires a victim with an active Cockpit session to visit a malicious link, allowing the attacker to execute commands with the privileges of the Cockpit process. The issue is resolved in Cockpit version 362.

Affected products

Cockpit Project Cockpit Before 362

Timeline

2026-03-25: other: Vulnerability reported to Red Hat Bugzilla
2026-05-11: disclosed: Initial CVE publication
2026-05-20: patched: Public disclosure of fix in Cockpit 362 and technical details on oss-security

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.