CVE-2026-4802

The record

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Affected packages

Related vulnerabilities

• CVE-2026-4631 Cockpit's remote login feature passes user-supplied hostnames and usernames from the web… Also affects cockpit
• CVE-2026-26996 minimatch is a minimal matching utility for converting glob expressions into JavaScript… Also affects cockpit
• CVE-2026-25547 @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Also affects cockpit
• CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the… Also affects cockpit
• CVE-2024-6126 A flaw was found in the cockpit package. Also affects cockpit
• CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
• CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
• CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78