Executive brief
cockpit-machines is a web interface component for managing virtual machines on Linux systems. A flaw allows local users to read plaintext VM credentials and passwords by inspecting process command-line arguments during VM creation or installation. An attacker with local system access can intercept these passwords without special tools, potentially gaining unauthorized access to managed virtual machines.
Technical details
The vulnerability stems from passing password values directly on the command line during VM creation or installation, exposing them via /proc/[pid]/cmdline inspection. Attack requires local system access and occurs during a specific execution window when the sensitive command is running. Successful exploitation results in plaintext credential disclosure (CWE-214) with no integrity or availability impact, only confidentiality compromise.
Affected products
- cockpit-machines
Timeline
- 2026-09-18: disclosed