The vulnerability CVE-2026-4631 affects the Cockpit web-based server administration tool in Red Hat Enterprise Linux 9.6 and 10. Cockpit's remote login feature improperly handles user-supplied hostnames and usernames by passing them directly to the SSH client without validation or sanitization. An attacker with network access can exploit this by sending a crafted HTTP request to the login endpoint, injecting malicious SSH command-line arguments or shell commands. This leads to unauthenticated remote code execution on the host running Cockpit, as the injection happens before any authentication checks. The issue is classified under CWE-78 (OS Command Injection) and has a CVSS 3.1 base score of 9.8 (critical). Red Hat has issued security advisories RHSA-2026:7381 and RHSA-2026:7382 with updated cockpit packages that fix this vulnerability.

Successful exploitation allows an unauthenticated attacker with network access to the Cockpit web service to execute arbitrary code on the Cockpit host. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The vulnerability is critical due to the lack of authentication requirement and the ability to execute commands remotely via the web interface.

Red Hat has released official security updates for Cockpit that fix this vulnerability by improving the handling of hostnames on the command line. Users should apply the updated cockpit packages provided in Red Hat Enterprise Linux 9.6 (cockpit-334.2-2.el9_6) and 10.0 (cockpit-334.1-3.el10_0) as detailed in advisories RHSA-2026:7381 and RHSA-2026:7382. Before applying these updates, ensure all previously released errata relevant to your system are installed. No other mitigations or workarounds are indicated by the vendor.