medium · CVSS v3 6.6

CVE-2026-125672

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated…

Description

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.

Scores

Severity
medium
CVSS v2
6.2
CVSS v3
6.6
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-89115

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

View analysis

medium

CVE-2026-89128

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

View analysis

medium

CVE-2026-89129

SAP NetWeaver AS Java Web Services is vulnerable to an unauthenticated Server‑Side Request Forgery (SSRF) that allows an attacker to trigger a SOAP fault to a URL under their control. This flaw can leak information about internal systems, compromising confidentiality. The vulnerability does not affect integrity or availability.

View analysis

medium

CVE-2026-89131

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

View analysis