CVE-2026-92745 is a local information disclosure vulnerability in cockpit-machines where a sensitive RHSM offline token is passed as a command-line argument to a helper script during token validation. This token is exposed in process metadata, allowing a local attacker with low privileges and user interaction to disclose the token if the system's /proc visibility settings are not restrictive. The vulnerability affects confidentiality by enabling the attacker to use the offline token to request access tokens. The issue is tracked under CWE-214 (Information Exposure Through Process Arguments). The vulnerability requires local access and the ability to inspect process metadata during the token validation flow.

The vulnerability allows a local attacker to disclose sensitive RHSM offline tokens, which can then be used to request access tokens, leading to a compromise of confidentiality. There is no impact on integrity or availability. Exploitation requires local access, low privileges, and user interaction, as well as a system configuration that permits process metadata inspection.

The vendor advisory does not explicitly state that a fix is available or provide patch links. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92745 for current remediation guidance. Mitigation includes restricting /proc visibility settings to prevent unauthorized process metadata inspection. Users should monitor the vendor advisory for updates on patches or official fixes.