# CVE-2026-4802: Cockpit command injection in system logs UI

Source: https://junglewise.ai/threats/cve-2026-4802-cockpit-command-injection-in-system-logs-ui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-4802 · Severity: high · CVSS 8 · Published 2026-05-11

Cockpit is a web-based interface used to manage and monitor Linux servers. A security flaw in its system logs component allows an attacker to execute malicious commands on the server if a logged-in administrator clicks on a specially crafted link. This could lead to a full takeover of the server, unauthorized data access, or service disruption.

Technologies: [Cockpit Project Cockpit](https://junglewise.ai/threats/technologies/cockpit). Vendors: [Cockpit Project](https://junglewise.ai/threats/vendors/cockpit-project).

## Quick answers

**Is CVE-2026-4802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4802 being exploited in the wild.

**How severe is CVE-2026-4802?** High severity, with a CVSS score of 8, published 11 May 2026.

**Which products and versions are affected?** Cockpit Project Cockpit Before 362, unspecified.

**Is there a fix for CVE-2026-4802?** A patch was published on 2026-05-20: Public disclosure of fix in Cockpit 362 and technical details on oss-security Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4802 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-4802?** Check whether you run Cockpit Project Cockpit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Cockpit's system logs UI, specifically within the 'loadServiceFilters()' path in 'pkg/systemd/logsJournal.jsx'. The application constructs shell commands by joining array elements into a string with insufficient sanitization before executing them via '/bin/bash -ec'. An attacker can provide malicious input through URL parameters (such as 'since' or 'boot') containing shell metacharacters or command substitutions (e.g., '$(...)'). Exploitation requires a victim with an active Cockpit session to visit a malicious link, allowing the attacker to execute commands with the privileges of the Cockpit process. The issue is resolved in Cockpit version 362.

## Affected products

- Cockpit Project Cockpit Before 362

## Timeline

- 2026-03-25: other: Vulnerability reported to Red Hat Bugzilla
- 2026-05-11: disclosed: Initial CVE publication
- 2026-05-20: patched: Public disclosure of fix in Cockpit 362 and technical details on oss-security

## References

- [https://access.redhat.com/security/cve/CVE-2026-4802](https://access.redhat.com/security/cve/CVE-2026-4802)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2451155](https://bugzilla.redhat.com/show_bug.cgi?id=2451155)
- [https://github.com/cockpit-project/cockpit/blob/e204cd130/pkg/systemd/logsJournal.jsx](https://github.com/cockpit-project/cockpit/blob/e204cd130/pkg/systemd/logsJournal.jsx)
- [http://www.openwall.com/lists/oss-security/2026/05/20/19](http://www.openwall.com/lists/oss-security/2026/05/20/19)

## Related threats

- [Cockpit denial of service via unbounded fragmented WebSocket messages](https://junglewise.ai/threats/cve-2026-91150-a-flaw-was-found-in-cockpit-this-vulnerability-allows-a-remote)
- [Cockpit CMS path traversal and local file inclusion in index.php](https://junglewise.ai/threats/cve-2026-58467-cockpit-cms-path-traversal-and-local-file-inclusion-in-index-php)