CVE-2026-92747: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Enterprise Linux 10
A vulnerability in cockpit-machines allows a local attacker with process inspection capabilities to expose sensitive guest VM credentials such as rootPassword and userPassword. This occurs because the install_machine.py script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the active installation workflow period and depends on host process-visibility policies.
AI Analysis
Technical Summary
CVE-2026-92747 is a vulnerability in cockpit-machines where sensitive guest virtual machine credentials are exposed to local users who can inspect running processes. The install_machine.py script passes credentials as JSON command-line arguments during VM installation, making them visible to other local users if host process-visibility policies allow. This exposure is temporary and only occurs while the installation workflow is active.
Potential Impact
The vulnerability allows local attackers with the ability to inspect running processes to read sensitive guest VM credentials, potentially compromising VM security. The impact is limited to confidentiality as it does not affect integrity or availability. The exposure window is restricted to the installation period and depends on host process-visibility settings.
Mitigation Recommendations
No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves restricting local user access and process visibility policies to prevent unauthorized inspection of running processes during VM installation.
CVE-2026-92747: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Enterprise Linux 10
Description
A vulnerability in cockpit-machines allows a local attacker with process inspection capabilities to expose sensitive guest VM credentials such as rootPassword and userPassword. This occurs because the install_machine.py script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the active installation workflow period and depends on host process-visibility policies.
CVSS v3.1
Score 5.0medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92747 is a vulnerability in cockpit-machines where sensitive guest virtual machine credentials are exposed to local users who can inspect running processes. The install_machine.py script passes credentials as JSON command-line arguments during VM installation, making them visible to other local users if host process-visibility policies allow. This exposure is temporary and only occurs while the installation workflow is active.
Potential Impact
The vulnerability allows local attackers with the ability to inspect running processes to read sensitive guest VM credentials, potentially compromising VM security. The impact is limited to confidentiality as it does not affect integrity or availability. The exposure window is restricted to the installation period and depends on host process-visibility settings.
Mitigation Recommendations
No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves restricting local user access and process visibility policies to prevent unauthorized inspection of running processes during VM installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8p9r-6652-9xc4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92747"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aade50855bf5e2cf5edac90
Added to database: 09/19/2026, 01:27:36 UTC
Last enriched: 09/19/2026, 01:37:52 UTC
Last updated: 09/19/2026, 04:01:24 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.