The vulnerability CVE-2026-4631 affects Red Hat Enterprise Linux 10's Cockpit remote login feature. It allows an unauthenticated attacker with network access to the Cockpit web service to perform OS command injection by sending specially crafted HTTP requests to the login endpoint. This happens because the application forwards user-supplied hostnames and usernames directly to the SSH client without sanitization, enabling injection of malicious SSH options or shell commands. Exploitation leads to code execution on the host system before any authentication occurs. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory does not currently specify a remediation level or patch availability.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Cockpit host system without any authentication. This compromises the confidentiality, integrity, and availability of the affected system. Given the pre-authentication nature and the ability to run commands on the host, the impact is critical.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-4631 for current remediation guidance. Until an official fix is released, restrict network access to the Cockpit web service to trusted users only and monitor for suspicious activity targeting the login endpoint. Avoid exposing the Cockpit interface to untrusted networks.