CVE-2026-92747

MediumCVSS 5.0/10Last modified Oct 21, 2026

Description

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-214

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Oct 21, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-927488.8BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to CVE-2026-927498.1SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to r CVE-2026-927506.5Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve CVE-2026-927518.1CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of CVE-2026-927528.3metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing re CVE-2026-927537.1PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filte CVE-2026-927544.3PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization deco CVE-2026-927565.5Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption se CVE-2026-927575.5Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable CVE-2026-927585.5If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in CVE-2026-927596.5SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the CVE-2026-927606.5Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscr