CVSS 3.1
7.3 highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVE-2026-91151 Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper
High (7.3) in red hat. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.
On this page
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
Severity
- EPSS
- 0.2% estimated probability of exploitation activity in the next 30 days; 6th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CISA's assessment (SSVC)
- Exploitation: PoC · Automatable: no · Technical impact: total, assessed 2026-11-13. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
- CWE
- CWE-59 Improper Link Resolution Before File Access (Link Following)
- OWASP Top 10
- A01:2025 Broken Access Control
- Published
- Modified
- Assigned by
- redhat (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-91151 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-91151?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-91151?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-91151 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-91151)
HTML:
<a href="https://cve.bz/cve/CVE-2026-91151"><img src="https://cve.bz/cve/badge/CVE-2026-91151.svg" alt="CVE-2026-91151"></a>
Affected
- red hat:red hat enterprise linux 10
- red hat:red hat enterprise linux 10.2 extended update support
- red hat:red hat enterprise linux 7
- red hat:red hat enterprise linux 8
- red hat:red hat enterprise linux 9
- red hat:red hat enterprise linux 9.8 extended update support
- red hat:red hat openshift dev spaces
Versions
From the CNA's record in the CVE List.
Fixed in
| Product | Fixed in |
|---|---|
| Red Hat Enterprise Linux 10 | 0:366.1.1-1.el10_3 |
| Red Hat Enterprise Linux 10.2 Extended Update Support | 0:356.4.1-1.el10_2 |
| Red Hat Enterprise Linux 8 | 0:310.10.2-1.el8_10 |
| Red Hat Enterprise Linux 9 | 0:366.1.1-1.el9_9 |
| Red Hat Enterprise Linux 9.8 Extended Update Support | 0:356.4.1-1.el9_8 |
Fix and patched versions
- Red Hat Red Hat Enterprise Linux 10: fixed in 0:366.1.1-1.el10_3
- Red Hat Red Hat Enterprise Linux 10.2 Extended Update Support: fixed in 0:356.4.1-1.el10_2
- Red Hat Red Hat Enterprise Linux 8: fixed in 0:310.10.2-1.el8_10
- Red Hat Red Hat Enterprise Linux 9: fixed in 0:366.1.1-1.el9_9
- Red Hat Red Hat Enterprise Linux 9.8 Extended Update Support: fixed in 0:356.4.1-1.el9_8
- Debian, Red Hat, Rocky Linux: fixed package versions per release
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13 | cockpit | no fix listed | DEBIAN-CVE-2026-91151 |
| Debian | 14 | cockpit | 372-1 | DEBIAN-CVE-2026-91151 |
| Ubuntu | 18.04:LTS, 20.04:LTS, 22.04:LTS and 3 more | cockpit | no fix listed | UBUNTU-CVE-2026-91151 |
| Red Hat | enterprise_linux:8::baseos | cockpit, cockpit-ws, cockpit-doc and 4 more | 0:310.10.2-1.el8_10 | RHSA-2026:99603 |
| Red Hat | enterprise_linux:9::appstream | cockpit-storaged, cockpit-packagekit | 0:366.1.1-1.el9_9 | RHSA-2026:99602 |
| Red Hat | enterprise_linux:9::baseos | cockpit, cockpit-ws, cockpit-doc and 5 more | 0:366.1.1-1.el9_9 | RHSA-2026:99602 |
| Red Hat | enterprise_linux:10.3 | cockpit, cockpit-ws, cockpit-doc and 7 more | 0:366.1.1-1.el10_3 | RHSA-2026:99600 |
| Red Hat | enterprise_linux_eus:10.2 | cockpit, cockpit-ws, cockpit-doc and 7 more | 0:356.4.1-1.el10_2 | RHSA-2026:99599 |
| Red Hat | rhel_eus:9.8::appstream | cockpit-storaged, cockpit-packagekit | 0:356.4.1-1.el9_8 | RHSA-2026:99601 |
| Red Hat | rhel_eus:9.8::baseos | cockpit, cockpit-ws, cockpit-doc and 5 more | 0:356.4.1-1.el9_8 | RHSA-2026:99601 |
| Rocky Linux | 8 | cockpit, cockpit-ws, cockpit-doc and 4 more | 0:310.10.2-1.el8_10 | RLSA-2026:99603 |
| Rocky Linux | 9 | cockpit, cockpit-ws, cockpit-doc and 7 more | 0:366.1.1-1.el9_9.rocky.0.1 | RLSA-2026:99602 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Red Hat Security Data © Red Hat, Inc., CC BY 4.0; Rocky Linux's errata, BSD-3-Clause. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu · Red Hat.
Red Hat
Red Hat rates this Important.
This Important flaw in Cockpit's `ssh-add-public-key.sh` helper allows a local authenticated user to escalate privileges. By manipulating symlinks within their home directory, an attacker can redirect privileged filesystem operations performed by the helper during the "Add public key" workflow in a privileged Cockpit session. This can lead to arbitrary ownership and mode changes on sensitive files, resulting in integrity, confidentiality, and availability impacts. Exploitation requires user interaction and a privileged execution context, preventing unauthenticated or remote attacks.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | cockpit | Affected | |
| Red Hat Enterprise Linux 7 | cockpit | Affected | |
| Red Hat Enterprise Linux 8 | cockpit | Affected | |
| Red Hat Enterprise Linux 9 | cockpit | Affected | |
| Red Hat OpenShift Dev Spaces | devspaces/udi-base-rhel10 | Affected | |
| Red Hat OpenShift Dev Spaces | devspaces/udi-base-rhel9 | Affected | |
| Red Hat OpenShift Dev Spaces | devspaces/udi-rhel9 | Affected |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-91151.
Attack patterns (CAPEC)
- CAPEC-17 Using Malicious Files Likelihood: High · Severity: Very High
- CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
- CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
- CAPEC-132 Symlink Attack Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.
References
- https://access.redhat.com/errata/RHSA-2026:99599
- https://access.redhat.com/errata/RHSA-2026:99600
- https://access.redhat.com/errata/RHSA-2026:99601
- https://access.redhat.com/errata/RHSA-2026:99602
- https://access.redhat.com/errata/RHSA-2026:99603
- https://access.redhat.com/security/cve/CVE-2026-91151
- https://bugzilla.redhat.com/show_bug.cgi?id=2478404
- https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23
- https://github.com/cockpit-project/cockpit/releases/tag/372