CVE-2026-113496

The record

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.

Affected packages

Related vulnerabilities

• CVE-2026-116246 To pass a server's password to psql and to the utilities pgAdmin 4 runs as background… CWE-214
• CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for… CWE-214
• CVE-2026-113495 A flaw was found in cockpit-machines. CWE-214
• CVE-2026-109971 A flaw was found in the clevis PKCS#11 pin. CWE-214
• CVE-2026-81684 In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI… CWE-214
• CVE-2026-80158 A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. CWE-214
• CVE-2026-65088 NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of… CWE-214
• CVE-2026-18915 Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM… CWE-214