ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91147

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

CVSS 3.1 5.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 3 Nov 2026 18:57:17 UTC. Read the latest advisory.

cve-program · CVE-2026-91147

Published

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91147

Published

cockpit

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cockpit",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:310.10-1.el8_10",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:8::baseos"
                    ]
                }

cockpit

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cockpit",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10"
                    ]
                }

cockpit

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cockpit",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:7"
                    ]
                }

cockpit

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cockpit",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:9"
                    ]
                }

devspaces/udi-base-rhel10

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Dev Spaces",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "devspaces/udi-base-rhel10",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_devspaces:3"
                    ]
                }

devspaces/udi-base-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Dev Spaces",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "devspaces/udi-base-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_devspaces:3"
                    ]
                }

devspaces/udi-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Dev Spaces",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "devspaces/udi-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_devspaces:3"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON