CVE-2026-92768 is a local information disclosure vulnerability in the cockpit-machines component. It arises from the practice of passing sensitive VM credentials, such as plaintext passwords, via command-line arguments during VM creation or installation. Since process command-line arguments can be inspected by other local users on systems where /proc visibility is not restricted, an attacker with local access can read these credentials. The vulnerability requires low privileges and no user interaction, with a low attack complexity and unchanged scope. Successful exploitation results in high confidentiality impact due to credential exposure, potentially compromising VM access.

The vulnerability allows local attackers to obtain sensitive VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. This can lead to unauthorized access to virtual machines. There is no impact on integrity or availability. Exploitation requires local access and a specific execution window.

No official fix or patch is currently confirmed in the vendor advisory. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92768 for current remediation guidance. Mitigation involves restricting visibility of process command-line arguments (e.g., limiting /proc access) to prevent other local users from reading sensitive information. Users should monitor Red Hat advisories for updates and apply patches when available.