Bug 2556057 (CVE-2026-113495)

Summary: CVE-2026-113495 cockpit-machines: RHSM access-token disclosure through image helper command-line arguments
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556059    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-20 09:28:32 UTC 
A flaw was found in cockpit-machines. The getRhelImageUrl() and downloadRhelImage() functions pass a Red Hat Subscription Management (RHSM) access token to Python helpers in JSON command-line arguments. When another user initiates an RHSM-backed image retrieval workflow, a local unprivileged attacker on a host permitting cross-user process inspection can read the token from the helper's command line. For system connections, the download helper requires elevated execution, and the token remains in its arguments while an image transfer is running. Disclosure of the bearer token may allow unauthorized access to RHSM resources within the token's permissions and validity period.