CVE-2026-91147
Description
A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
Statement
This Moderate availability flaw in cockpit-ws can lead to a denial of service. Exploitation requires a non-default [WebService] UrlRoot configuration and an unauthenticated request to the exact configured URL-root prefix without a trailing slash, which must reach cockpit-ws without front-end normalization or redirection. This makes the vulnerability less easily exploitable in typical Red Hat deployments.
Mitigation
A code fix is being pursued for the affected streams. Until updated packages are available, avoid configuring a non-empty [WebService] UrlRoot in cockpit-ws where feasible. If a non-empty UrlRoot is required, configure the front-end proxy or TLS terminator in front of cockpit-ws to rewrite or redirect requests for the exact configured prefix (for example, /cockpit) to the trailing-slash form (for example, /cockpit/) before forwarding them, so the exact-prefix request never reaches cockpit-ws unnormalized. Deployments whose front end already normalizes or redirects such requests are not exposed through that route.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Acknowledgements
This issue was discovered by Found by AISLE in partnership with Red Hat.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
