The vulnerability in cockpit‑machines causes Red Hat Subscription Management authentication tokens to be passed as command‑line arguments to background helper processes during image retrieval operations. This weakness corresponds to CWE‑214. A local, unprivileged attacker who has the ability to perform cross‑user process inspection can read these command‑line arguments while the process is active, revealing the RHSM token. The disclosed token can grant the attacker unauthorized access to RHSM resources for the duration of its validity, enabling information disclosure and potential exploitation of subscription management services.

Systems running Red Hat Enterprise Linux 9 or Red Hat Enterprise Linux 10 that have the cockpit‑machines component installed are affected. The vulnerability exists in the ticketed version(s) of cockpit‑machines shipped with those operating system releases; no specific sub‑version narrowing is available in the current data.

The CVSS score is 5, indicating a moderate severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likelihood of exploitation remains low to moderate, contingent on the presence of local attack privileges and the ability to inspect processes owned by other users. Attackers with local, unprivileged access who can observe /proc filesystem entries are able to retrieve the token. Once obtained, the token can be used to access RHSM resources until it expires. No immediate exploit code is reported, and no official workaround is available from Red Hat at this time.