Bug 2556059

Summary: CVE-2026-113495 cockpit-machines: RHSM access-token disclosure through image helper command-line arguments [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: cockpit-machinesAssignee: Katerina Koukiou <kkoukiou>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: jvanderwaa, kkoukiou, martin, mmarusak, tmatus
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["f856099d-ee48-4383-823e-1318c4688ab2"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2556057    

Description Vladimir Vasilev 2026-10-20 09:39:06 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in cockpit-machines. The getRhelImageUrl() and downloadRhelImage() functions pass a Red Hat Subscription Management (RHSM) access token to Python helpers in JSON command-line arguments. When another user initiates an RHSM-backed image retrieval workflow, a local unprivileged attacker on a host permitting cross-user process inspection can read the token from the helper's command line. For system connections, the download helper requires elevated execution, and the token remains in its arguments while an image transfer is running. Disclosure of the bearer token may allow unauthorized access to RHSM resources within the token's permissions and validity period.