CVE-2026-4631

Name of the Vulnerable Software and Affected Versions Cockpit versions prior to 360

Description The remote login feature in Cockpit fails to validate or sanitize user-supplied hostnames and usernames passed from the web interface to the SSH client. An attacker with network access to the web service can send a single HTTP request to the login endpoint to inject malicious SSH options or shell commands, such as using ProxyCommand, leading to remote code execution on the host. This occurs during the authentication flow before credential verification, allowing the attack to be carried out without valid credentials. Approximately 1.3 million services are estimated to be potentially affected worldwide.

Recommendations Update Cockpit to version 360.