CVE-2026-92745 is a local information disclosure vulnerability in the cockpit-machines component of Red Hat Enterprise Linux 10. It occurs because the RHSM offline token is passed as a command-line argument to a helper script during token validation, making it visible in process metadata. A local attacker with the ability to inspect process metadata during the validation process can disclose this sensitive token. The vulnerability requires local access, low privileges, and user interaction, and is contingent on the system not having restrictive /proc visibility settings. The disclosed token can be used to request access tokens, leading to confidentiality compromise. The CVSS v3.1 base score is 5.0 (medium severity) with a vector of AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N.

The vulnerability allows a local attacker to disclose a sensitive RHSM offline token by inspecting process metadata. This token disclosure can lead to compromise of confidentiality because the token can be used to request further access tokens. There is no impact on integrity or availability. Exploitation requires local access and the ability to inspect process metadata during the token validation process.

Red Hat has published an advisory for CVE-2026-92745 but does not explicitly state that a fix is available yet. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92745 for current remediation guidance. Mitigation includes ensuring restrictive /proc visibility settings to prevent unauthorized process metadata inspection. Since exploitation requires local access and process metadata visibility, restricting these can reduce risk.