CVE-2026-92768

Name of the Vulnerable Software and Affected Versions cockpit-machines (affected versions not specified)

Description A flaw in the cockpit-machines component allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords. This occurs because the component passes password values directly as command-line arguments during VM creation or installation, making them visible to other local users on systems where process arguments are not restricted. This leads to information disclosure that could compromise VM access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.