Cockpit-machines stores the VNC console password in plain text and passes it directly as a command-line argument to an underlying system utility. When a local, non-privileged user on a host that permits cross-user process inspection saves or modifies VNC settings, the password can be read from the process list by another user. This allows the attacker to gain unauthorized access to the graphical console of a target virtual machine without affecting the host itself.

Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 are identified as affected by the Red Hat CPS. The vulnerability is present in the cockpit-machines component that manages virtual machine console settings.

The CVSS base score is 5, indicating a medium severity credential-disclosure vulnerability. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires that an attacker be able to inspect processes from another user account; if such cross-user visibility exists, the attacker can read the exposed password and access the guest VM console. The risk is moderate and does not enable broader compromise of the host system.