Executive brief
cockpit-machines is a Linux system management tool that integrates with Red Hat Subscription Management to validate subscription tokens. A flaw allows local attackers to view sensitive offline subscription tokens by inspecting process command-line arguments during token validation, potentially enabling unauthorized access to subscription services. Exploitation requires local system access and the ability to monitor process metadata, but does not need elevated privileges.
Technical details
A local information disclosure vulnerability (CWE-214) in cockpit-machines exposes RHSM offline tokens when they are passed as command-line arguments to a helper script during token validation. An attacker with local user privileges can inspect process metadata via /proc to capture the token while validation is in progress, then use it to request access tokens. The vulnerability requires local host access, low privileges, and window of time during the validation workflow.
Affected products
- Red Hat cockpit-machines
Timeline
- 2026-09-18: disclosed