CVE-2026-91205

Overview

CVE-2026-91205 is a race condition in cockpit-files that allows a local unprivileged user to manipulate directory ownership changes. By creating a symlink in a writable parent directory, the attacker can redirect chown to an arbitrary file. This can lead to unauthorized modification or information disclosure of sensitive files.

Description

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

Impact

Confidentiality: potential disclosure of sensitive files. Integrity: unauthorized modification of files. Availability: minimal. Impacted parties: local users with unprivileged accounts on systems running cockpit-files, especially those with writable parent directories.

Remediation

Apply the latest cockpit update that fixes the race condition. Ensure that parent directories used by cockpit-files are not world-writable or writable by unprivileged users. Use file system permissions to restrict symlink creation. Consider disabling the directory creation feature if not needed.

Risk context

The vulnerability has a medium severity score (CVSS 6.0) and no EPSS data, indicating a moderate risk that should be addressed promptly but is not an immediate critical threat.

Affected products

• cockpit
• cockpit-files
• Red Hat Enterprise Linux
• Fedora
• CentOS