CVE-2026-91151
Last modified
CVE-2026-91151 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 10.2 Extended Update Support | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
| Red Hat | Red Hat Enterprise Linux 9.8 Extended Update Support | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat OpenShift Dev Spaces | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-91151?
How severe is CVE-2026-91151?
How do I fix CVE-2026-91151?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91145Activiti through 7.1.0.M6 fails to validate hash-brace defer…7.1
- CVE-2026-91146Takahe through 0.11.0 fails to restrict URL schemes in link …6.1
- CVE-2026-91147A flaw was found in `cockpit-ws`. This vulnerability allows …5.9
- CVE-2026-91149A flaw was found in Cockpit. An unauthenticated remote attac…7.5
- CVE-2026-9115Insufficient policy enforcement in Service Worker in Google …4.3
- CVE-2026-91150A flaw was found in Cockpit. This vulnerability allows a rem…7.5
- CVE-2026-91152The Everest Forms – Contact Form, Payment Form, Quiz, Survey…6.1
- CVE-2026-91153The Everest Forms – Contact Form, Payment Form, Quiz, Survey…5.3
- CVE-2026-91154Missing Authentication for Critical Function (CWE-306) in th…6.9
- CVE-2026-91156Discourse is an open-source discussion platform. Prior to 20…7.5
- CVE-2026-91157Discourse is an open-source discussion platform. Prior to 20…7.5
- CVE-2026-91159Discourse is an open-source discussion platform. Prior to 20…7.7
Are you affected by CVE-2026-91151?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST