CVE-2026-4631

DOCUMENTATION: Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability. 

            STATEMENT: Two configuration factors determine whether a Cockpit installation is vulnerable to remote code execution.

First, the hostname injection attack (injecting SSH options like -oProxyCommand via the URL path) is blocked by OpenSSH 9.6 and later, which validates hostnames and rejects shell metacharacters before establishing a connection. Systems running Cockpit 327 or later with an OpenSSH version older than 9.6 are vulnerable to unauthenticated remote code execution in the default configuration. Systems with OpenSSH 9.6 or later are not vulnerable to this attack path.

Second, the username injection attack (injecting shell commands via the SSH username) requires that the system's SSH configuration uses the %r (remote username) token within a Match exec directive. This is not part of any default OpenSSH configuration. Systems that do not use %r in a Match exec directive are not vulnerable to this attack path, regardless of OpenSSH version.

Both attack paths require network access to the Cockpit web service (port 9090 by default) and that remote host login is enabled, which is the default Cockpit configuration.