The vulnerability exists in Cockpit's remote login feature, which passes user-supplied hostnames and usernames from the web interface to the SSH client without proper validation or sanitization. An attacker can exploit this by sending a specially crafted HTTP request to the login endpoint, injecting malicious SSH command-line arguments or shell commands. This injection occurs during the authentication flow before any credential checks, enabling code execution on the Cockpit host without valid credentials. The issue is tracked as CWE-78 (OS Command Injection) and has a CVSS 3.1 score of 9.8 (critical). Red Hat has issued security advisories RHSA-2026:7381 and RHSA-2026:7382 providing updated cockpit packages that fix this vulnerability.

Successful exploitation results in unauthenticated remote code execution on the Cockpit host, compromising confidentiality, integrity, and availability of the affected system. Since the injection occurs before authentication, no valid credentials are required, making the attack highly severe. This can lead to full system compromise of Red Hat Enterprise Linux 9.6 and 10.0 systems running vulnerable Cockpit versions.

Red Hat has released official security updates for Cockpit that address this vulnerability. Users should apply the updates provided in advisories RHSA-2026:7381 and RHSA-2026:7382 as soon as possible. Before applying these updates, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's guidance at https://access.redhat.com/articles/11258 for update instructions. No other mitigation or workaround is indicated by the vendor advisory.