CVE-2026-91147 is a denial of service vulnerability in cockpit-ws caused by improper handling of requests made exactly to the configured WebService.UrlRoot without a trailing slash. When such a request is received, cockpit-ws terminates unexpectedly, leading to service unavailability. The vulnerability requires a non-default UrlRoot configuration and an unauthenticated remote attacker to send a crafted request that bypasses front-end normalization or redirection. The issue is tracked as CWE-617 (Reachable Assertion).

The vulnerability results in a denial of service condition by crashing the cockpit-ws service, causing unavailability of the Cockpit web service. There is no impact on confidentiality or integrity. The attack complexity is high, and no privileges or user interaction are required. The vulnerability is less easily exploitable in typical Red Hat deployments due to the requirement for specific configuration and request conditions.

Red Hat has published an advisory detailing the issue but does not explicitly confirm availability of a patch at this time. Exploitation requires a non-default UrlRoot configuration and a request that bypasses front-end normalization or redirection, which reduces risk in typical deployments. Users should review the Red Hat advisory for updates on patch availability and consider avoiding non-default UrlRoot configurations or ensuring front-end components normalize or redirect requests to include trailing slashes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.