Denial of Service Vulnerability in Cockpit (CVE-2026-91149)

• •CVE-2026-91149 allows unauthenticated DoS attacks on Cockpit.
• •Attackers can exhaust system resources by flooding connections to the service.
• •No active exploitation reported, but urgent remediation is recommended.

A critical vulnerability identified as CVE-2026-91149 affects the Cockpit management interface, allowing unauthenticated remote attackers to exploit the `cockpit-tls` service. By initiating numerous simultaneous connections, attackers can create an unbounded number of detached threads, leading to denial of service (DoS) and making the service unavailable for legitimate users. The flaw primarily affects systems with exposed Cockpit deployments, particularly those on servers and bastion hosts. The vulnerability was published on September 18, 2026, and while it poses a high availability risk, there are currently no reports of active exploitation. Recommended mitigations include restricting access and applying vendor fixes promptly. Monitoring for unusual connection patterns is also advised.