{"id":"CVE-2026-91151","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-91151","summary":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh`…","details":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.","published":"2026-11-11T20:17:10.557","modified":"2026-11-11T20:17:10.700","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23","label":"cockpit-project/cockpit@4796b28"},"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-91151"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"},{"type":"WEB","url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"},{"type":"WEB","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T20:17:10.700"}}