Cockpit 368
Cockpit is the modern Linux admin interface. We release regularly.
Here are the release notes from Cockpit 368, cockpit-machines 357, and cockpit-files 45:
tls: Limit concurrent connections [CVE-2026-91149]
cockpit-tls now limits the amount of concurrent connections to a sensible default of 500, and can be modified in cockpit.conf WebService section with MaxConcurrentConnections.
Impact
A Denial of Service attack on cockpit-tls made in possible for unauthenticated remote clients to create detached threads which consume process resources, and degrade or deny service availability.
Affected systems
The affected versions are up to and including Cockpit 367. (cockpit <= 367)
This is tracked as CVE-2026-91149.
shell: SSH keys are now easier to add
We have improved our SSH keys modal to now include a file chooser with system navigation, recent history, and common locations to improve the user experience in finding the necessary files.
Machines: Security hardening of CLI usage [CVE-2026-92768] [CVE-2026-92747] [CVE-2026-92745]
Impact
An attacker with system access could access sensitive VM credentials, including plaintext passwords and RHSM tokens, by inspecting process command-line arguments during VM creation or installation.
Affected systems
The affected Cockpit Machines versions are up to and including Cockpit Machines 356. (cockpit-machines <= 356)
This is tracked in three CVEs as CVE-2026-92768 CVE-2026-92747 CVE-2026-92745.
Files: Security hardening of CLI usage [CVE-2026-91202] [CVE-2026-91203] [CVE-2026-91205]
Impact
An attacker with system access could redirect file ownership to change arbitrary files, allowing the attacker to potentially read and write to unauthorized files.
Affected systems
The affected Cockpit Files versions of CVE-2026-91203, CVE-2026-91205 are up to and including Cockpit Files 44. (cockpit-files <= 44)
The affected Cockpit Files versions of CVE-2026-91202 are Cockpit Files 16 up to and including Cockpit Files 44. (cockpit-files >= 16, cockpit-files <= 44)
This is tracked in three CVEs as CVE-2026-91202 CVE-2026-91203 CVE-2026-91205.
Try it out
cockpit 368, cockpit-machines 357, and cockpit-files 45 are available now: