CVE-2026-92745 is a local information disclosure vulnerability in cockpit-machines. It allows a local attacker with the ability to inspect process metadata to disclose a sensitive RHSM offline token. This token is passed as a command-line argument to a helper script during token validation, making it visible to processes that can inspect command-line arguments. Successful exploitation compromises confidentiality by enabling the attacker to use the offline token to request access tokens. Exploitation requires local access, low complexity, and user interaction, with no impact on integrity or availability. The vulnerability affects multiple specific versions of cockpit-machines as listed.

The vulnerability leads to the compromise of confidentiality by exposing the RHSM offline token. An attacker with local access and the ability to inspect process metadata can obtain this token and use it to request access tokens. There is no impact on integrity or availability. The CVSS v3.1 base score is 5.0 (medium severity).

No official fix or patch is explicitly stated in the advisory. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92745 for current remediation guidance. Exploitation requires local access and the ability to inspect process metadata during token validation, so restricting /proc visibility and limiting local user privileges can reduce risk. Customers should monitor Red Hat advisories for updates and apply fixes when available.