CVE Alert: CVE-2026-91149 – Red Hat

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.

## AI Summary Analysis

**Risk verdict:** High availability risk requiring prompt remediation; no active exploitation signal or KEV status is supplied, so emergency handling is not yet justified.

**Why this matters:** An attacker can exhaust host resources and make the management interface unavailable, disrupting administration, monitoring and incident response. The realistic goal is service outage or operational distraction rather than data theft or system takeover; repeated automated connections make the activity inexpensive to conduct.

**Most likely attack path:** The exposed network service can be reached remotely without authentication or user interaction, with no meaningful attacker-side complexity. Sustained connection floods cause resource consumption within the affected service; scope is unchanged, so direct lateral movement is not expected, although loss of management access can hinder recovery of other systems.

**Who is most exposed:** Internet-facing or broadly reachable Cockpit deployments on servers, bastion hosts and administration networks are the priority. Container images and developer workspaces embedding the affected management component also warrant review.

Alert on sharp increases in concurrent connections to the Cockpit TLS listener.

Monitor process thread counts, open file descriptors and memory growth for the service.

Correlate connection churn with service restarts, timeouts and failed administrator logins.

Review firewall, load-balancer and host logs for repeated sources or distributed connection floods.

Mitigation and prioritisation:

Apply the vendor-fixed package through normal expedited change control; validate service health afterwards.

Until patched, restrict access to trusted administration networks or VPNs and block public exposure.

Enforce connection limits, idle timeouts and rate limiting at the firewall or reverse proxy where supported.

Prepare console or out-of-band administration in case the management service becomes unavailable.

Reassess priority when KEV, EPSS or exploitation telemetry becomes available; current SSVC indicates no exploitation but confirms automation potential.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.