A flaw was found in cockpit-machines. The getRhelImageUrl() and downloadRhelImage() functions pass a Red Hat Subscription Management (RHSM) access token to Python helpers in JSON command-line arguments. When another user initiates an RHSM-backed image retrieval workflow, a local unprivileged attacker on a host permitting cross-user process inspection can read the token from the helper's command line. For system connections, the download helper requires elevated execution, and the token remains in its arguments while an image transfer is running. Disclosure of the bearer token may allow unauthorized access to RHSM resources within the token's permissions and validity period.