Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

ELSA-2026-7384 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceELSA-2026-7384

ELSA-2026-7384

CRITICAL

ELSA-2026-7384: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (CRITICAL)

Published Apr 10, 2026

Modified 6 days ago

Fix available

Details

[344-2.0.1]

Storage: Enable btrfs support [Orabug: 37464632]
Replaced upstream urls in documentation with oracle links [Orabug: 36528753]
Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
Remove duplicate reference to server in cockpit [Orabug: 34030494]
Update documentation links [Orabug: 30271413], [Orabug: 32013095], [Orabug: 32795691], [Orabug: 34398512], [Orabug: 34742876], [Orabug: 37253273]
Update spec file for new release

[344]

Remove recommends on subscription-manager-cockpit if applicable

Fri Mar 27 2026 Jelle van der Waa <jvanderw@redhat.com - 344-2

ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

Affected Packages

cockpit

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-bridge

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-doc

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-packagekit

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-storaged

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-system

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-ws

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

cockpit-ws-selinux

OracleLinux 9

Fixed in:

0:344-2.0.1.el9_7

Related

Ecosystems

Timeline

PublishedApr 10, 2026

ModifiedApr 10, 2026