A critical remote code execution vulnerability affects Cockpit server management software versions 327 through 359. Tracked as CVE-2026-4631, the flaw requires no authentication and can be exploited over the network.
The issue is an SSH argument injection in Cockpit’s login handling. An attacker can inject a ProxyCommand parameter through a crafted URL, causing the server to execute arbitrary commands when it attempts an SSH connection. Two attack vectors exist: one through the hostname parameter and another via username token injection using the %r token.
The exploit was authored by security researcher @intx0x80 and published on April 18, 2026. The PoC includes both exploitation and time-based detection capabilities, making it straightforward to verify whether a target is vulnerable.
Administrators running Cockpit should update to a patched version immediately. If patching isn’t feasible, restrict network access to the Cockpit interface (default port 9090) to trusted hosts only. The vulnerability is particularly dangerous because it requires zero authentication and can be triggered with a single HTTP request.
