Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 360:

ws: Prevent remote code execution with SSH argument injection [CVE-2026-4631]

Impact

Cockpit’s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Affected systems

The affected Cockpit versions are Cockpit 326 up to and including Cockpit 359. (cockpit >= 326, cockpit <= 359)

This is tracked as CVE-2026-4631.

Fix

• Upgrade to Cockpit version 360 to fix this issue.
• The official Debian patch includes all required changes and is applicable to recent Cockpit versions.
• You can alternatively backport the following patches:
  • https://github.com/cockpit-project/cockpit/commit/9d0695647cb6f6209e68231fd165917123aa502d
  • https://github.com/allisonkarlitskaya/ferny/commit/44ec511c99

Workarounds

A workaround is disabling LoginTo option in cockpit.conf, this disables the direct login feature but it is still strongly recommended to upgrade to Cockpit 360.

Acknowledgments

Many thanks to Florian Kohnhäuser for reporting this issue!

Try it out

Cockpit 360 is available now:

• For your Linux system

• Cockpit Client

• Cockpit Source Tarball
• Cockpit Fedora 44
• Cockpit Fedora 43