Bug 2556060

Summary: CVE-2026-113496 cockpit-machines: VNC console password disclosure through virt-xml command-line arguments [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: cockpit-machinesAssignee: Katerina Koukiou <kkoukiou>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: jvanderwaa, kkoukiou, martin, mmarusak, tmatus
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["4762d6cd-b956-467f-a383-7e2d0692e0e3"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2556058    

Description Vladimir Vasilev 2026-10-20 09:39:15 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in cockpit-machines. Saving VNC console settings passes the configured password through virtXmlEdit() and runVirtXml() into a virt-xml --graphics command-line argument. A local unprivileged attacker on a host permitting cross-user process inspection can read the password while another user saves the settings. Because the dialog also submits an existing password when other settings are changed, changing only the console port can expose the credential again. A disclosed password may allow unauthorized access to a guest's VNC console when the console is active, reachable, and accepts that password. Loopback-only listening does not by itself prevent access by a local attacker.