CVE-2026-91151

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.