{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125672", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-11-10T09:32:23.544Z", "datePublished": "2026-11-10T10:43:39.678Z", "dateUpdated": "2026-11-10T10:43:39.678Z"}, "containers": {"cna": {"title": "Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-125672", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569357", "name": "RHBZ#2569357", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-10T09:18:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-88: Improper Neutralization of Argument Delimiters in a Command", "workarounds": [{"lang": "en", "value": "There is no complete mitigation available without a code fix. As a partial mitigation, administrators can restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and should carefully verify the Keyserver address shown in the \"Edit Tang keyserver\" dialog before clicking Save -- a value that does not resemble a well-formed hostname (for example, one starting with a hyphen) should not be accepted."}], "timeline": [{"lang": "en", "time": "2026-10-21T04:10:42.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-10T09:18:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Andrey Vasilevsky for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-10T10:43:39.678Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "unknown", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user."}], "id": "CVE-2026-125672", "lastModified": "2026-11-10T11:16:43.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.2, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-11-10T11:16:43.203", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-125672"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569357"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Andrey Vasilevsky for reporting this issue.", "bugzilla": {"description": "cockpit: cockpit-storaged: Tang keyserver address from an untrusted LUKS header clevis token reaches curl's argument vector as an option", "id": "2569357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569357"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-88", "details": ["A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation available without a code fix. As a partial mitigation, administrators can restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and should carefully verify the Keyserver address shown in the \"Edit Tang keyserver\" dialog before clicking Save -- a value that does not resemble a well-formed hostname (for example, one starting with a hyphen) should not be accepted."}, "name": "CVE-2026-125672", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Out of support scope", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-10T09:18:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-125672\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-125672"], "statement": "Exploitation of this flaw requires an unprivileged local user with an active console or desktop login session on the host -- a plain SSH or Cockpit web session is not sufficient for the underlying device-attachment step -- in addition to an administratively-privileged Cockpit user opening the affected device's \"Edit Tang keyserver\" dialog and saving it without noticing the malformed value. No non-default configuration of Cockpit or the affected host is required for the flaw to be reachable once these conditions are met.", "threat_severity": "Moderate"}

{}