Cockpit’s remote login feature directly passes user‑supplied hostnames and usernames to the underlying SSH client without any validation or sanitization. An attacker who can reach the Cockpit web service can send a single HTTP request to the login endpoint that injects malicious SSH options or shell commands. This injection occurs during the authentication flow before any credential verification, allowing the attacker to execute arbitrary code on the Cockpit host without valid credentials, effectively providing full system compromise. The weakness is an OS command‑injection flaw classified as CWE‑78.

The vulnerability affects Red Hat Enterprise Linux systems that run the Cockpit service, including RHEL 7, RHEL 8, RHEL 9, RHEL 9 × 6 EUS, RHEL 10, and RHEL 10 0 EUS. Users of the Cockpit web interface on these platforms are at risk if the service is exposed to untrusted networks.

With a CVSS score of 9.8 the vulnerability is high severity. The EPSS score of 3 % indicates a low predicted exploitation probability, but the absence of a credential requirement and the simplicity of the attack vector—crafting an HTTP request to the web service—make it a straightforward threat for attackers who can reach the Cockpit instance. The issue is not listed in the CISA KEV catalog, so no public exploit is currently documented; however, the attack could be performed by any network attacker with access to the Cockpit service, making risk very high for exposed systems.