CVE-2026-91147 is a denial of service vulnerability in cockpit-ws triggered when a remote unauthenticated attacker sends a request to the exact URL-root prefix configured via WebService.UrlRoot without a trailing slash. This causes cockpit-ws to terminate unexpectedly, resulting in service unavailability. The vulnerability requires a non-default UrlRoot configuration and that the request reaches cockpit-ws without front-end normalization or redirection, reducing exploitability in typical deployments. The flaw is categorized under CWE-617 (Reachable Assertion).

The vulnerability leads to a denial of service condition by causing cockpit-ws to crash or exit unexpectedly, resulting in the unavailability of the Cockpit web service. There is no impact on confidentiality or integrity. Exploitation requires network access and no privileges or user interaction, but the attack complexity is high due to configuration and network path requirements.

No official fix or patch information is provided in the advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Exploitation is less likely in typical Red Hat deployments due to the need for a non-default UrlRoot configuration and lack of front-end normalization or redirection. Users should verify their WebService.UrlRoot configuration and consider applying any vendor-provided updates once available.