Cockpit is the modern Linux admin interface. We release regularly.
Here are the release notes from Cockpit 360:
ws: Prevent remote code execution with SSH argument injection [CVE-2026-4631]
Impact
Cockpit’s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Affected systems
The affected Cockpit versions are Cockpit 326 up to and including Cockpit 359. (cockpit >= 326, cockpit <= 359)
This is tracked as CVE-2026-4631.
Fix
- Upgrade to Cockpit version 360 to fix this issue.
- The official Debian patch includes all required changes and is applicable to recent Cockpit versions.
- You can alternatively backport the following patches:
Workarounds
A workaround is disabling LoginTo option in cockpit.conf, this disables the direct login feature but it is still strongly recommended to upgrade to Cockpit 360.
Acknowledgments
Many thanks to Florian Kohnhäuser for reporting this issue!
Try it out
Cockpit 360 is available now: