Security update for cockpit-machines

🗓️ 10 Apr 2026 11:36:32Reported by SuseType

suse🔗 www.suse.com👁 9 Views

Security update for cockpit-machines fixes unbounded brace expansion and minimatch ReDoS vulnerabilities.

Reporter	Title	Published	Views	Family All 1017
vulnersOsv	10up-toolkit (>=6.0.0-next.0, <=7.0.0-next.1), @0ti.me/ts-test-deps (0.2.0) +6560 more potentially affected by CVE-2026-26996 via minimatch (>=9.0.0, <=9.0.5)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	-tompan-reacttemplate (>=1.0.1, <=1.1.0), 02.aula (1.0.0) +55793 more potentially affected by CVE-2026-26996 via minimatch (>=3.0.0, <=3.1.2)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @10xly/eslint-config (>=1.0.0, <=1.0.8) +1098 more potentially affected by CVE-2026-26996 via minimatch (>=10.0.0, <=10.1.3)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +318 more potentially affected by CVE-2026-26996 via minimatch (>=7.0.0, <=7.4.6)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-26996 via minimatch (>=6.0.0, <=6.2.0)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-26996 via minimatch (>=6.0.0, <=6.2.0)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	02strich-markdown (>=1.0.0, <=1.0.2), @0xintuition/slang-cli (>=0.0.1-b, <=0.0.8) +1943 more potentially affected by CVE-2026-26996 via minimatch (>=4.1.1, <=4.2.3)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +318 more potentially affected by CVE-2026-26996 via minimatch (>=7.0.0, <=7.4.6)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@aadarshjr/reweb-js (>=1.0.7, <=1.0.17), @acentswap/ace-core-trial (>=10.4.0, <=10.7.0) +898 more potentially affected by CVE-2026-26996 via minimatch (>=5.0.0, <=5.1.6)	18 Feb 202622:38	–	vulnersosv
vulnersOsv	@aadarshjr/reweb-js (>=1.0.7, <=1.0.17), @acentswap/ace-core-trial (>=10.4.0, <=10.7.0) +898 more potentially affected by CVE-2026-26996 via minimatch (>=5.0.0, <=5.1.6)	18 Feb 202622:38	–	vulnersosv

OS	OS Version	Architecture	Package	Package Version	Filename
suse	5.2	noarch	cockpit-machines	249.1	cockpit-machines-249.1-150300.5.6.1.noarch.rpm

Source	Link
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi
suse	www.suse.com/security/cve/CVE-2026-25547.html
suse	www.suse.com/security/cve/CVE-2026-26996.html
suse	www.suse.com/security/cve/CVE-2026-25547.html
suse	www.suse.com/security/cve/CVE-2026-26996.html
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi

10 Apr 2026 11:36Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

CVSS 48.7

EPSS0.00519

brace expansion minimatch ReDoS nodejs crash high cpu usage memory consumption security patch suse microos patch