The SUSE Product Security Team released an update for cockpit that fixes four vulnerabilities: CVE-2026-4802 allows remote command execution through crafted links in system logs due to unsanitized user input; CVE-2026-25547 involves unbounded brace expansion in Node.js leading to excessive CPU and memory usage and potential crashes; CVE-2026-27606 is an arbitrary file write vulnerability via path traversal in Rollup 4; CVE-2026-27904 is a Regular Expression Denial of Service (ReDoS) in minimatch caused by nested extglobs with exponential backtracking complexity. These vulnerabilities affect the security and stability of the affected components and have been addressed in this update.

Successful exploitation of these vulnerabilities could lead to remote command execution, denial of service through resource exhaustion or crashes, and arbitrary file writes which may compromise system integrity or availability. The remote command execution vulnerability (CVE-2026-4802) is particularly critical as it allows attackers to execute commands remotely via crafted system log links. The other vulnerabilities can cause service disruption or unauthorized file modifications.

A security update has been released by the SUSE Product Security Team addressing these vulnerabilities. Applying this official update is the recommended remediation. No additional mitigation steps are indicated beyond installing the provided fix.