Cockpit Security Update — AlmaLinux 9 (ALSA-2026:94533)
ALSA-2026:94533 updates Cockpit on AlmaLinux 9, fixing CVE-2026-91147, CVE-2026-91149 and CVE-2026-76235 — denial-of-service and session-handling flaws (CWE-617 reachable via the web console) at aggregate CVSS 5.9. Update with dnf update cockpit and restart the cockpit service.
What this means under a SharedLicense license
Cockpit is the server's admin web console — denial-of-service or session flaws there either take the management interface offline or disrupt authenticated admin sessions during incident response.
Type:
security
Severity:
important
Release date:
2026-11-04
Description:
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)
* cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
* cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | cockpit-ws-356.4-1.el9_8.aarch64.rpm | 0383a2c31206b7c4b72a7e6795b514753a7c9c79d476257fa5662fe6ef1a5f8b |
| aarch64 | cockpit-ws-selinux-356.4-1.el9_8.aarch64.rpm | b70b7ff9faf062a9f3c2a092372d87052fa2cbeef3ac6b2245c47a8b63a7493a |
| aarch64 | cockpit-356.4-1.el9_8.aarch64.rpm | d2fba3ea7114ee802c313af7f5a4963e7716dda41d45a2671c34a09cb1728cb6 |
| noarch | cockpit-storaged-356.4-1.el9_8.noarch.rpm | 45895ef4d132e0966b6d96a1fd282f427f16df53775bb19e5e46af9bf1f397a3 |
| noarch | cockpit-system-356.4-1.el9_8.noarch.rpm | 55c33fbaa81d442e1880fb958a0e1f954549638b8e7424313d004c71d058170c |
| noarch | cockpit-doc-356.4-1.el9_8.noarch.rpm | b182e122607802cfa0c3580fedc9306d50f06915b485c9762567562829fa6c29 |
| noarch | cockpit-packagekit-356.4-1.el9_8.noarch.rpm | c82efbfcd2cbbec8e08b935862a376ff62335b91b7973da3bb165ba75c2368bb |
| noarch | cockpit-bridge-356.4-1.el9_8.noarch.rpm | ee4fd632a0241fd946707cfd2062271edc046e80a0e110d4a24640f048b757a4 |
| ppc64le | cockpit-356.4-1.el9_8.ppc64le.rpm | 70185be13ace9e8b70c4910a69e2f1aabe96df8f3e16f64f4da708e9c402eb87 |
| ppc64le | cockpit-ws-selinux-356.4-1.el9_8.ppc64le.rpm | aef97e46392218a5d91fe15528c15bb9756383f894fb72b92e8e70a087fc9fa6 |
| ppc64le | cockpit-ws-356.4-1.el9_8.ppc64le.rpm | d58b0d3d676d5dd3e522836f5f73e16ea2c5bec9d93cddde495bd50f1a3cfc76 |
| s390x | cockpit-ws-356.4-1.el9_8.s390x.rpm | 3adb8d4305f414c355b45d37cbf6bce3dc181360ca09cdd9a4365b440aefb1da |
| s390x | cockpit-356.4-1.el9_8.s390x.rpm | 912544b4367c4451b6ec22deb661a40dd61649ce5a007efbb657c1a576f24813 |
| s390x | cockpit-ws-selinux-356.4-1.el9_8.s390x.rpm | b7610f44c5f845a30151ffeff4b99f4d88e01739bd05fcb025369a9ee427893f |
| x86_64 | cockpit-ws-selinux-356.4-1.el9_8.x86_64.rpm | 83cbf728fedf83095bb1b1fd4c601ae9e263dc8434f71e2d3dfa2dbe1888c2f6 |
| x86_64 | cockpit-ws-356.4-1.el9_8.x86_64.rpm | ad5c14aca19ba5567dd2cc6c335edcc10ce07a17a177d50cea9c46cb552a1053 |
| x86_64 | cockpit-356.4-1.el9_8.x86_64.rpm | c77fe47998ec28bf49bcb796334a72fe12ecb32f1b14e6b2f9f8ca90397c00a1 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
Frequently Asked Questions
What is ALSA-2026:94533?
Who is affected?
How do I apply the fix?
Why patch a management console promptly?
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System