Executive brief
Red Hat Cockpit is a web-based system management interface for Linux servers. A flaw in its URL-root configuration allows remote attackers without authentication to crash the web service by sending a specially crafted request, causing the management interface to become unavailable. This impacts administrators' ability to manage systems remotely until the service is restarted.
Technical details
The vulnerability is a reachable assertion (CWE-617) in cockpit-ws triggered when WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash. The flaw causes an unhandled exception that terminates the service process. Exploitation requires network access and a non-default configuration; typical deployments with front-end normalization or redirection are less vulnerable.
Affected products
- Red Hat Cockpit Multiple versions with non-default UrlRoot configuration
Timeline
- 2026-09-18: disclosed