Cockpit Project

Cockpit 360

Wed, 08 Apr 2026 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 360:

ws: Prevent remote code execution with SSH argument injection [CVE-2026-4631]

Impact

Cockpit’s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Affected systems

The affected Cockpit versions are Cockpit 326 up to and including Cockpit 359. (cockpit >= 326, cockpit <= 359)

This is tracked as CVE-2026-4631.

Fix

Upgrade to Cockpit version 360 to fix this issue.
The official Debian patch includes all required changes and is applicable to recent Cockpit versions.
You can alternatively backport the following patches:
- https://github.com/cockpit-project/cockpit/commit/9d0695647cb6f6209e68231fd165917123aa502d
- https://github.com/allisonkarlitskaya/ferny/commit/44ec511c99

Workarounds

A workaround is disabling LoginTo option in cockpit.conf, this disables the direct login feature but it is still strongly recommended to upgrade to Cockpit 360.

Acknowledgments

Many thanks to Florian Kohnhäuser for reporting this issue!

Try it out

Cockpit 360 is available now:

Cockpit 358

Wed, 18 Mar 2026 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 358 and cockpit-files 38:

Cockpit Client updated to GTK 4

The Cockpit Client has been updated to GTK 4 and WebKit 6, making it easier to enable support for downloads from Cockpit Files.

Networking: Add Wi-Fi support

If there are any Wi-Fi devices, the Networking page overview shows the number of available networks and the currently connected network.

The details page shows a table of available networks with mode/security, signal strength, and rate. The currently active connection (if any) is always at the top. It is followed by known networks, and then unknown networks sorted by descending signal strength. You can connect, disconnect, and forget networks.

Files: Add confirmation prompt for discarding changes

When editing files, Cockpit will now show a confirmation dialog when clicking away, hitting cancel, or pressing escape. This prevents accidentally discarding changes and losing data.

Thanks to Leone25 for this contribution!

Try it out

Cockpit 358, cockpit-files 38, cockpit-machines 350 and cockpit-podman 123 are available now:

Cockpit 357

Wed, 25 Feb 2026 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 357, cockpit-files 37, cockpit-machines 350 and cockpit-podman 123:

Show browser context menu when holding `Shift`

To help with accessibility and user-specific items in your browser context menu we now follow the behavior seen in Firefox: holding the Shift key while right-clicking will skip our own context menu and instead follow the default behavior of your browser. Note that while Cockpit Files uses the Cockpit context menu it did not receive this update before the release, but will get it for the for next one.

Machines: Support for kernel boot arguments when creating VMs

Cockpit now supports the --extra-args option of virt-install. This allows you to pass arguments to the kernel when the installer is booted during the creation of a new virtual machine. Installers like Anaconda and Agama can be controlled in various ways via these arguments.

Thanks to Nykseli for this contribution!

Podman: Show description, version and documentation image labels

The image details tab now shows a select set of labels from the OpenContainers Annotations specification.

Try it out

Cockpit 357, cockpit-files 37, cockpit-machines 350 and cockpit-podman 123 are available now:

Cockpit 356

Wed, 11 Feb 2026 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 356:

Services: Timers created by Cockpit run shell commands and can be edited

The systemd timer units created by Cockpit now run their command via the shell. Previously, the text you entered into the “Command” field was used directly for the ExecStart value in the systemd service unit for the timer, and was thus subject to systemd specifier expansion and other idiosyncrasies. Now the text you enter is executed directly by /bin/sh.

Systemd timer units that have been created by this version of Cockpit (or later) can now also be edited in Cockpit.

Thanks to Miguel Ribeiro for contributing this feature!

Try it out

Cockpit 356 is available now:

Cockpit 355

Thu, 29 Jan 2026 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 355:

Add systemd/polkit-based fallback for administrative privileges if sudo is not available

There are systems like Ubuntu 25.10 which don’t have sudo, or only the incompatible sudo-rs. Cockpit previously failed to gain administrator rights then. Cockpit 355 now both detects and ignores an incompatible sudo, as well as introduces a fallback authentication method: It starts the root bridge through systemd’s StartTransientUnit() API. This is inspired by systemd’s run0, and uses the exact same underlying mechanism. This is guarded by polkit, so you need to authorize with your user password similar to sudo.

ws: Remove obsolete pam_cockpit_cert module

Cockpit version 209 (Dec 2019) introduced a pam_cockpit_cert PAM module in /etc/pam.d/cockpit. Cockpit 248 (Jul 2021) made this module unnecessary, and replaced the module with a stub that did not do anything, plus a warning during package upgrade.

This version finally removes it. So if you have locally modified /etc/pam.d/cockpit and still have that module in your configuration, you need to manually remove it.

Try it out

Cockpit 355 is available now:

Cockpit 353

Wed, 10 Dec 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 353:

Networking: Suggest prefix length and gateway address

IPv4 and IPv6 configuration dialogs now automatically pre-fill network prefix length and default gateway. Prefix length defaults to classful addressing in IPv4 and /64 prefix is suggested for IPv6. Classless addressing is fully supported and manual overrides are available, the default gateway is calculated as the first usable address of the subnet.

Try it out

Cockpit 353 is available now:

Cockpit 352

Wed, 26 Nov 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 352 and cockpit-machines 345:

Show a warning if the last shutdown/reboot was unclean

Cockpit’s healtchard will now show warning when the system was shutdown uncleanly.

Machines: New virtual machines don’t get SPICE graphics anymore

Cockpit used to add both VNC and SPICE graphics when creating new virtual machines. Now only VNC graphics are added. We have made this change since Cockpit itself does not benefit from SPICE graphics, and we think that opening the SPICE port for a running machine should be intentional on part of the user and not happen silently and surprisingly.

Try it out

Cockpit 352 and cockpit-machines 345 are available now:

Cockpit 351

Tue, 11 Nov 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 351, and cockpit-machines 344:

Firewall: Additional ports can now be deleted

“Additional ports” in a firewall zone are now listed each in their individual row, and can be individually deleted.

Thanks a lot libkurisu for this contribution!

Machines: VMs can be shutdown and restarted with a single action

Some changes to a virtual machine, such as adding VNC graphics, require it to be completely shut down and restarted before these changes take effect. Cockpit can now do this with a single action.

Machines: Support for network port forwarding

Cockpit can now configure port forwarding for virtual machines on the user session.

Try it out

Cockpit 351, cockpit-machines 344, and cockpit-podman 117 are available now:

Cockpit 350

Wed, 29 Oct 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from cockpit-machines 343 and cockpit-podman 116:

Machines: Memory usage now shows numbers reported by the guest

The memory usage bars now show the same numbers as tools like “top” and “free” when run inside the guest. Specifically, the memory usage shown by Cockpit is based on the “MemAvailable” number of the guest kernel.

To implement this, Cockpit will run virsh dommemstat <vm name> --period 10 --life. If that is not acceptable, please let us know.

Support stopping/starting/restarting quadlets

Quadlets now have lifecycle operations such as “Start”. These use systemd operations instead of podman’s API.

Try it out

cockpit-machines 343 and cockpit-podman 116 are available now:

Cockpit 349

Wed, 15 Oct 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 349, and cockpit-podman 115:

Package manifests: Add `any` test

Package manifests can have a list of conditions. Cockpit will only consider the package if all conditions are met. This release introduces an operator for alternative checks in a condition, for example

"conditions": [
    {"any": [{"path-exists": "…/packagekit.service"}, {"path-exists": "…/dnfdaemon.service"}]}
]

That condition will be true if at least one of its subconditions matches.

List stopped quadlets

Quadlets are a declarative way to define podman pods/containers using systemd-like configuration files. These podman containers/pods are ephemeral and previously disappeared from cockpit-podman when stopped.

With this release, cockpit-podman can now detect stopped quadlets on the system for the logged in user and superuser. The quadlets are shown as normal “inactive” pods/containers. In the future, lifecycle actions such as start/stop/restart will be added.

Try it out

Cockpit 349, cockpit-podman 115, cockpit-files 30, cockpit-machines 342, and cockpit-ostree 216 are available now:

Cockpit 348

Thu, 02 Oct 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from cockpit-machines 341:

Machines: Improved UX for Disks and Network interface tables

Looking at a Virtual Machine’s available disks or the designated network interfaces there was too much detail being displayed, causing unintended wrapping and making some parts impossible to read with certain screen resolutions.

To alleviate this we have changed the UI around to showcase only the most important information a user would want and hid the rest within an expandable section.

All the information we had prior to this change is still here, but in a much easier to read design.

Try it out

Cockpit 348, cockpit-podman 114, cockpit-files 29, cockpit-machines 341, and cockpit-ostree 215 are available now:

Cockpit 347

Wed, 17 Sep 2025 00:00:00 +0000

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 347 and cockpit-machines 340:

Site-specific branding support

Administrators can provide a custom local branding in /etc/cockpit/branding/ (more generally, $XDG_CONFIG_DIRS/cockpit/branding/). If that directory exists, it is considered before the system package branding directories in /usr.

Machines: Exclusive VNC connections with “Remote resizing”

A VNC viewer can tell the VNC server whether or not it wants exclusive access to it, or whether it is okay that multiple viewers display and interact with the same console. Until now, Cockpit has always allowed shared access when it connects.

Now, Cockpit will request exclusive access when it is in the “Remote resizing” mode, to avoid having multiple viewers make conflicting resize requests.

This feature requires the web server from Cockpit 346.

Try it out

Cockpit 347 and cockpit-machines 340 are available now:

Cockpit Project

Cockpit 360

ws: Prevent remote code execution with SSH argument injection [CVE-2026-4631]

Impact

Affected systems

Fix

Workarounds

Acknowledgments

Try it out

Cockpit 358

Cockpit Client updated to GTK 4

Networking: Add Wi-Fi support

Files: Add confirmation prompt for discarding changes

Try it out

Cockpit 357

Show browser context menu when holding Shift

Machines: Support for kernel boot arguments when creating VMs

Podman: Show description, version and documentation image labels

Try it out

Cockpit 356

Services: Timers created by Cockpit run shell commands and can be edited

Try it out

Cockpit 355

Add systemd/polkit-based fallback for administrative privileges if sudo is not available

ws: Remove obsolete pam_cockpit_cert module

Try it out

Cockpit 353

Networking: Suggest prefix length and gateway address

Try it out

Cockpit 352

Show a warning if the last shutdown/reboot was unclean

Machines: New virtual machines don’t get SPICE graphics anymore

Try it out

Cockpit 351

Firewall: Additional ports can now be deleted

Machines: VMs can be shutdown and restarted with a single action

Machines: Support for network port forwarding

Try it out

Cockpit 350

Machines: Memory usage now shows numbers reported by the guest

Support stopping/starting/restarting quadlets

Try it out

Cockpit 349

Package manifests: Add any test

List stopped quadlets

Try it out

Cockpit 348

Machines: Improved UX for Disks and Network interface tables

Try it out

Cockpit 347

Site-specific branding support

Machines: Exclusive VNC connections with “Remote resizing”

Try it out

Show browser context menu when holding `Shift`

Package manifests: Add `any` test