Executive brief
Cockpit Machines is a web-based interface for managing virtual machines in Linux environments. A local attacker who can inspect running processes can view sensitive virtual machine credentials (passwords) that are passed as command-line arguments during VM creation, exposing root and user passwords to other local users on the same host.
Technical details
The vulnerability exists in the install_machine.py script, which passes VM credentials as JSON command-line arguments during VM creation or installation. A local attacker with sufficient process-visibility permissions can read these credentials from the process list. This is a CWE-214 weakness (invocation of process using visible sensitive information). The exposure window is limited to the active installation workflow and depends on host-level process visibility policies.
Affected products
- Red Hat Cockpit Machines
Timeline
- 2026-09-18: disclosed