CVE-2026-113496
5 MEDIUMPublished 2026-10-20 · Updated 2026-10-20
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-214
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-102371PoC
- MEDIUMCVE-2026-109971
- MEDIUMCVE-2026-113495
- MEDIUMCVE-2026-61670PoC
- MEDIUMCVE-2026-92171
- MEDIUMCVE-2026-92745
- MEDIUMCVE-2026-92747
- MEDIUMCVE-2026-92768
Related by shared AI tags and CWE weakness class. Browse the full archive.