Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments
Historical advisory recorded 11 Nov 2026 12:57:25 UTC. Read the latest advisory.
cve-program · CVE-2026-92745
PublishedA flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-92745
PublishedCockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.
- Source published
- 18 Sep 2026 17:53:29 UTC
- Source modified
- 11 Nov 2026 11:49:48 UTC
- Saved here
- 11 Nov 2026 12:57:25 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N