Updated cockpit-338 packages fix security vulnerability

🗓️ 16 Apr 2026 17:53:04Reported by Gentoo FoundationType

Cockpit-338 updates fix unauthenticated remote code execution via secure shell argument injection, CVE-2026-4631.

Reporter	Title	Published	Views	Family All 68
GithubExploit	Exploit for CVE-2026-4631	18 Apr 202620:30	–	githubexploit
ATTACKERKB	CVE-2026-4631	7 Apr 202616:30	–	attackerkb
Tenable Nessus	AlmaLinux 10 : cockpitUnauthenticated remote code execution due to SSH command-line argument injection (Critical) (ALSA-2026:7383)	15 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : cockpitUnauthenticated remote code execution due to SSH command-line argument injection (Critical) (ALSA-2026:7384)	16 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 42 : cockpit (2026-134819a61b)	28 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 43 : cockpit (2026-42f1aaa820)	9 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 44 : cockpit (2026-ea792bf240)	16 Apr 202600:00	–	nessus
Tenable Nessus	MiracleLinux 9 : cockpit-344-2.el9_7.ML.1 (AXSA:2026-473:03)	21 Apr 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : cockpit: / Unauthenticated / remote / code / execution / due / to / SSH / command-line / argument / injection / (CRITICAL) (ELSA-2026-7383)	14 Apr 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : cockpit: / Unauthenticated / remote / code / execution / due / to / SSH / command-line / argument / injection / (CRITICAL) (ELSA-2026-7384)	17 Apr 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Mageia	9	any	cockpit	338-1.7	cockpit-338-1.7.noarch.rpm

Source	Link
bugs	www.bugs.mageia.org/show_bug.cgi

16 Apr 2026 17:53Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.19.8

EPSS0.13889

SSVC