CVE-2026-113496: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Enterprise Linux 10

The vulnerability arises from cockpit-machines saving VNC console settings by passing the configured password directly as a command-line argument to an underlying system utility. Because command-line arguments can be viewed by other users on the same host who have cross-user process inspection capabilities, an unprivileged local attacker can extract the VNC password. This credential disclosure enables unauthorized access to the guest VM's graphical console. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, user interaction required, and high confidentiality impact with no integrity or availability impact.

An unprivileged local attacker on the affected system can obtain the VNC console password by inspecting process command-line arguments during configuration changes. This disclosure compromises the confidentiality of the VNC password, potentially allowing unauthorized access to the guest virtual machine's graphical console. There is no direct impact on system integrity or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-113496 for current remediation guidance. Until a fix is applied, restrict local user permissions to prevent unauthorized process inspection and avoid modifying VNC console settings in multi-user environments where untrusted users have access.