{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for cockpit is now available for Red Hat Enterprise Linux 9.", "title": "Topic" }, { "category": "general", "text": "Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nBug Fix(es) and Enhancement(s):\n\n* cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection [rhel-9.8] (JIRA:RHEL-158310)\n\n* cockpit: lodash: Arbitrary code execution via untrusted input in template imports [rhel-9.8] (JIRA:RHEL-164196)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHBA-2026:21387", "url": "https://access.redhat.com/errata/RHBA-2026:21387" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_21387.json" } ], "title": "Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update", "tracking": { "current_release_date": "2026-08-20T16:20:19+00:00", "generator": { "date": "2026-08-20T16:20:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.16" } }, "id": "RHBA-2026:21387", "initial_release_date": "2026-05-27T21:13:25+00:00", "revision_history": [ { "date": "2026-05-27T21:13:25+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-05-27T21:13:25+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-08-20T16:20:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.8.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 9)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "cockpit-0:356.1-1.el9_8.src", "product": { "name": "cockpit-0:356.1-1.el9_8.src", "product_id": "cockpit-0:356.1-1.el9_8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit@356.1-1.el9_8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "cockpit-0:356.1-1.el9_8.aarch64", "product": { "name": "cockpit-0:356.1-1.el9_8.aarch64", "product_id": "cockpit-0:356.1-1.el9_8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit@356.1-1.el9_8?arch=aarch64" } } }, { "category": "product_version", "name": "cockpit-ws-0:356.1-1.el9_8.aarch64", "product": { "name": "cockpit-ws-0:356.1-1.el9_8.aarch64", "product_id": "cockpit-ws-0:356.1-1.el9_8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el9_8?arch=aarch64" } } }, { "category": "product_version", "name": "cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "product": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "product_id": "cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el9_8?arch=aarch64" } } }, { "category": "product_version", "name": "cockpit-debugsource-0:356.1-1.el9_8.aarch64", "product": { "name": "cockpit-debugsource-0:356.1-1.el9_8.aarch64", "product_id": "cockpit-debugsource-0:356.1-1.el9_8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el9_8?arch=aarch64" } } }, { "category": "product_version", "name": "cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "product": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "product_id": "cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el9_8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "cockpit-0:356.1-1.el9_8.ppc64le", "product": { "name": "cockpit-0:356.1-1.el9_8.ppc64le", "product_id": "cockpit-0:356.1-1.el9_8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit@356.1-1.el9_8?arch=ppc64le" } } }, { "category": "product_version", "name": "cockpit-ws-0:356.1-1.el9_8.ppc64le", "product": { "name": "cockpit-ws-0:356.1-1.el9_8.ppc64le", "product_id": "cockpit-ws-0:356.1-1.el9_8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el9_8?arch=ppc64le" } } }, { "category": "product_version", "name": "cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "product": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "product_id": "cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el9_8?arch=ppc64le" } } }, { "category": "product_version", "name": "cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "product": { "name": "cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "product_id": "cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el9_8?arch=ppc64le" } } }, { "category": "product_version", "name": "cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "product": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "product_id": "cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el9_8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "cockpit-0:356.1-1.el9_8.x86_64", "product": { "name": "cockpit-0:356.1-1.el9_8.x86_64", "product_id": "cockpit-0:356.1-1.el9_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit@356.1-1.el9_8?arch=x86_64" } } }, { "category": "product_version", "name": "cockpit-ws-0:356.1-1.el9_8.x86_64", "product": { "name": "cockpit-ws-0:356.1-1.el9_8.x86_64", "product_id": "cockpit-ws-0:356.1-1.el9_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el9_8?arch=x86_64" } } }, { "category": "product_version", "name": "cockpit-ws-selinux-0:356.1-1.el9_8.x86_64", "product": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.x86_64", "product_id": "cockpit-ws-selinux-0:356.1-1.el9_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el9_8?arch=x86_64" } } }, { "category": "product_version", "name": "cockpit-debugsource-0:356.1-1.el9_8.x86_64", "product": { "name": "cockpit-debugsource-0:356.1-1.el9_8.x86_64", "product_id": "cockpit-debugsource-0:356.1-1.el9_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el9_8?arch=x86_64" } } }, { "category": "product_version", "name": "cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "product": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "product_id": "cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el9_8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "cockpit-0:356.1-1.el9_8.s390x", "product": { "name": "cockpit-0:356.1-1.el9_8.s390x", "product_id": "cockpit-0:356.1-1.el9_8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit@356.1-1.el9_8?arch=s390x" } } }, { "category": "product_version", "name": "cockpit-ws-0:356.1-1.el9_8.s390x", "product": { "name": "cockpit-ws-0:356.1-1.el9_8.s390x", "product_id": "cockpit-ws-0:356.1-1.el9_8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el9_8?arch=s390x" } } }, { "category": "product_version", "name": "cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "product": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "product_id": "cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el9_8?arch=s390x" } } }, { "category": "product_version", "name": "cockpit-debugsource-0:356.1-1.el9_8.s390x", "product": { "name": "cockpit-debugsource-0:356.1-1.el9_8.s390x", "product_id": "cockpit-debugsource-0:356.1-1.el9_8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el9_8?arch=s390x" } } }, { "category": "product_version", "name": "cockpit-debuginfo-0:356.1-1.el9_8.s390x", "product": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.s390x", "product_id": "cockpit-debuginfo-0:356.1-1.el9_8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el9_8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "cockpit-bridge-0:356.1-1.el9_8.noarch", "product": { "name": "cockpit-bridge-0:356.1-1.el9_8.noarch", "product_id": "cockpit-bridge-0:356.1-1.el9_8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-bridge@356.1-1.el9_8?arch=noarch" } } }, { "category": "product_version", "name": "cockpit-doc-0:356.1-1.el9_8.noarch", "product": { "name": "cockpit-doc-0:356.1-1.el9_8.noarch", "product_id": "cockpit-doc-0:356.1-1.el9_8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-doc@356.1-1.el9_8?arch=noarch" } } }, { "category": "product_version", "name": "cockpit-system-0:356.1-1.el9_8.noarch", "product": { "name": "cockpit-system-0:356.1-1.el9_8.noarch", "product_id": "cockpit-system-0:356.1-1.el9_8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-system@356.1-1.el9_8?arch=noarch" } } }, { "category": "product_version", "name": "cockpit-packagekit-0:356.1-1.el9_8.noarch", "product": { "name": "cockpit-packagekit-0:356.1-1.el9_8.noarch", "product_id": "cockpit-packagekit-0:356.1-1.el9_8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-packagekit@356.1-1.el9_8?arch=noarch" } } }, { "category": "product_version", "name": "cockpit-storaged-0:356.1-1.el9_8.noarch", "product": { "name": "cockpit-storaged-0:356.1-1.el9_8.noarch", "product_id": "cockpit-storaged-0:356.1-1.el9_8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/cockpit-storaged@356.1-1.el9_8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cockpit-packagekit-0:356.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.8.0.Z.MAIN.EUS:cockpit-packagekit-0:356.1-1.el9_8.noarch" }, "product_reference": "cockpit-packagekit-0:356.1-1.el9_8.noarch", "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-storaged-0:356.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.8.0.Z.MAIN.EUS:cockpit-storaged-0:356.1-1.el9_8.noarch" }, "product_reference": "cockpit-storaged-0:356.1-1.el9_8.noarch", "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-0:356.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.aarch64" }, "product_reference": "cockpit-0:356.1-1.el9_8.aarch64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-0:356.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.ppc64le" }, "product_reference": "cockpit-0:356.1-1.el9_8.ppc64le", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-0:356.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.s390x" }, "product_reference": "cockpit-0:356.1-1.el9_8.s390x", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-0:356.1-1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.src" }, "product_reference": "cockpit-0:356.1-1.el9_8.src", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-0:356.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.x86_64" }, "product_reference": "cockpit-0:356.1-1.el9_8.x86_64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-bridge-0:356.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-bridge-0:356.1-1.el9_8.noarch" }, "product_reference": "cockpit-bridge-0:356.1-1.el9_8.noarch", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.aarch64" }, "product_reference": "cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.ppc64le" }, "product_reference": "cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.s390x" }, "product_reference": "cockpit-debuginfo-0:356.1-1.el9_8.s390x", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debuginfo-0:356.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.x86_64" }, "product_reference": "cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debugsource-0:356.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.aarch64" }, "product_reference": "cockpit-debugsource-0:356.1-1.el9_8.aarch64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debugsource-0:356.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.ppc64le" }, "product_reference": "cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debugsource-0:356.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.s390x" }, "product_reference": "cockpit-debugsource-0:356.1-1.el9_8.s390x", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-debugsource-0:356.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.x86_64" }, "product_reference": "cockpit-debugsource-0:356.1-1.el9_8.x86_64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-doc-0:356.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-doc-0:356.1-1.el9_8.noarch" }, "product_reference": "cockpit-doc-0:356.1-1.el9_8.noarch", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-system-0:356.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-system-0:356.1-1.el9_8.noarch" }, "product_reference": "cockpit-system-0:356.1-1.el9_8.noarch", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-0:356.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.aarch64" }, "product_reference": "cockpit-ws-0:356.1-1.el9_8.aarch64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-0:356.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.ppc64le" }, "product_reference": "cockpit-ws-0:356.1-1.el9_8.ppc64le", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-0:356.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.s390x" }, "product_reference": "cockpit-ws-0:356.1-1.el9_8.s390x", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-0:356.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.x86_64" }, "product_reference": "cockpit-ws-0:356.1-1.el9_8.x86_64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.aarch64" }, "product_reference": "cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le" }, "product_reference": "cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.s390x" }, "product_reference": "cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "cockpit-ws-selinux-0:356.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)", "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.x86_64" }, "product_reference": "cockpit-ws-selinux-0:356.1-1.el9_8.x86_64", "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-4800", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "discovery_date": "2026-03-31T20:01:21.918257+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2453496" } ], "notes": [ { "category": "description", "text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().", "title": "Vulnerability description" }, { "category": "summary", "text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports", "title": "Vulnerability summary" }, { "category": "other", "text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user's browser. Consequently, the attack surface is strictly restricted to the local browser environment.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.8.0.Z.MAIN.EUS:cockpit-packagekit-0:356.1-1.el9_8.noarch", "AppStream-9.8.0.Z.MAIN.EUS:cockpit-storaged-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.src", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-bridge-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-doc-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-system-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-4800" }, { "category": "external", "summary": "RHBZ#2453496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800" }, { "category": "external", "summary": "https://cna.openjsf.org/security-advisories.html", "url": "https://cna.openjsf.org/security-advisories.html" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm", "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm" }, { "category": "external", "summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c", "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c" } ], "release_date": "2026-03-31T19:25:55.987000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-05-27T21:13:25+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.8.0.Z.MAIN.EUS:cockpit-packagekit-0:356.1-1.el9_8.noarch", "AppStream-9.8.0.Z.MAIN.EUS:cockpit-storaged-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.src", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-bridge-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-doc-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-system-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2026:21387" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.8.0.Z.MAIN.EUS:cockpit-packagekit-0:356.1-1.el9_8.noarch", "AppStream-9.8.0.Z.MAIN.EUS:cockpit-storaged-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.src", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-bridge-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-doc-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-system-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.8.0.Z.MAIN.EUS:cockpit-packagekit-0:356.1-1.el9_8.noarch", "AppStream-9.8.0.Z.MAIN.EUS:cockpit-storaged-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.src", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-bridge-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debuginfo-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-debugsource-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-doc-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-system-0:356.1-1.el9_8.noarch", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-0:356.1-1.el9_8.x86_64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.aarch64", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.ppc64le", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.s390x", "BaseOS-9.8.0.Z.MAIN.EUS:cockpit-ws-selinux-0:356.1-1.el9_8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports" } ] }