CVE-2026-92747 is a vulnerability in cockpit-machines where sensitive guest VM credentials (rootPassword and userPassword) are exposed to local attackers who can inspect running processes. The install_machine.py script passes these credentials as JSON command-line arguments during VM creation or installation, making them visible in the process list. This exposure is transient, limited to the installation workflow duration, and contingent on host process-visibility policies. The CVSS 3.1 base score is 5.0 (medium severity) with an attack vector of local, low complexity, and low privileges required. The vulnerability does not affect integrity or availability but impacts confidentiality.

Local attackers with the ability to inspect running processes on the host can view sensitive guest VM credentials during the VM installation process. This could lead to unauthorized access to guest VMs if the credentials are exposed. The exposure window is limited to the installation workflow period and depends on host process visibility settings.

No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves restricting local process visibility to trusted users only to prevent unauthorized access to process command-line arguments during VM installation. Avoid running VM installations on multi-tenant hosts where untrusted users have process inspection capabilities.