This vulnerability arises from the install_machine.py script in cockpit-machines passing sensitive guest VM credentials (rootPassword and userPassword) as JSON command-line arguments during VM creation or installation. Local attackers with the ability to inspect running processes on the host can expose these credentials. The exposure window is limited to the active installation workflow and is contingent on host process-visibility settings. Red Hat is currently investigating this issue, and no explicit patch or fix status is provided in the advisory.

The impact is the potential exposure of sensitive guest VM credentials to local users who can inspect running processes on the host. This could lead to unauthorized access to guest VMs if an attacker obtains these credentials. The exposure is temporary and limited to the installation period and depends on host process-visibility policies. There is no indication of remote exploitation or impact beyond credential disclosure.

Red Hat's advisory states the issue is under investigation and does not currently provide a patch or official fix. Since the exposure depends on host process-visibility policies, restricting local user access and limiting process inspection capabilities can reduce risk. Monitor Red Hat's advisory page for updates and apply any forthcoming patches or mitigations as recommended.