Cockpit is a web-based interface for administering GNU/Linux servers, providing features such as network configuration, log inspection, and interactive command-line sessions. The vulnerability CVE-2026-4631 involves unauthenticated remote code execution caused by SSH command-line argument injection due to insufficient sanitization of hostnames in the cockpit-ws component. Red Hat has released an update for Red Hat Enterprise Linux 9 to explicitly handle hostnames more securely on the command line, mitigating this issue. The advisory does not provide a CVSS score but rates the severity as critical.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely on affected systems via the cockpit web service. This could lead to full system compromise given the critical severity rating and the nature of remote code execution.

Red Hat has released updated cockpit packages for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants that fix this vulnerability. Users should apply these updates promptly. Before applying this update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.