CVE-2026-92768 is a local information disclosure vulnerability in the cockpit-machines component of Red Hat Enterprise Linux 10. The flaw arises because cockpit-machines passes VM credentials, including plaintext passwords, as command-line arguments during VM creation or installation. Since command-line arguments can be inspected by other local users on systems where process argument visibility is not restricted, an attacker with local access and low privileges can obtain sensitive VM credentials. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting a medium severity impact with high confidentiality impact but no integrity or availability impact.

Successful exploitation allows a local attacker to disclose sensitive VM credentials, including plaintext passwords, by inspecting process command-line arguments. This information disclosure could lead to unauthorized access to virtual machines. There is no impact on system integrity or availability. The vulnerability requires local access with low privileges and no user interaction.

Red Hat has published an advisory for CVE-2026-92768 but has not explicitly stated the availability of a patch or fix in the provided content. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92768 for current remediation guidance. In the meantime, restricting access to process command-line arguments on affected systems can reduce exposure. Users should monitor the vendor advisory for updates on fixes or mitigations.