CVE-2026-113495: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises because RHSM authentication tokens are exposed as command-line arguments to background helper processes invoked by cockpit-machines during image retrieval operations. Since command-line arguments can be viewed by other local users with process inspection capabilities, an unprivileged local attacker can obtain these sensitive tokens. The tokens grant access to RHSM resources, so their disclosure can lead to unauthorized resource access within the token's validity window.

The primary impact is information disclosure of RHSM authentication tokens to local unprivileged users who can inspect processes. This can lead to unauthorized access to Red Hat Subscription Management resources for the duration the token remains valid. There is no indication of privilege escalation, denial of service, or remote exploitation in the provided data.

The vendor advisory from Red Hat should be consulted for current remediation guidance. No explicit patch or fix information is provided in the input data, so patch status is not yet confirmed. Users should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-113495 for updates and apply any official fixes once available. Until then, limiting local user process inspection capabilities can reduce exposure.