CVE-2026-91203 in Cockpit
Summary
by MITRE • 09/18/2026
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within cockpit-files represents a classic privilege escalation vector rooted in improper handling of temporary resources during privileged operations. Specifically, the flaw involves a symlink race condition that occurs when the software performs file ownership changes or permission modifications using elevated privileges. In this scenario, an attacker with local access can manipulate directory entries to create symbolic links pointing to arbitrary system files before the vulnerable process completes its intended operation. By carefully timing these manipulations, the attacker wins the race condition, causing the privileged application to inadvertently alter the attributes of a target file rather than the intended temporary or user-controlled file. This mechanism allows for unauthorized modification of critical system states, effectively bypassing standard access controls through exploitation of the operating system's atomicity assumptions regarding symbolic link resolution during setuid or root-level operations.
From a technical perspective, this flaw aligns with CWE-367, Time-of-check to time-of-use (TOCTOU) race conditions, where the security check performed on a resource is not consistent with its use later in the execution flow. The attacker exploits the window between the initial validation of the file path and the actual system call that modifies ownership or permissions. Because cockpit-files operates with higher privileges than standard user processes, any successful exploitation grants the local attacker the ability to change the owner or permission bits of files they would otherwise not have access to modify. This capability is particularly dangerous as it can be used to overwrite configuration files, replace executable binaries, or alter sensitive data stores, thereby establishing persistence or enabling further privilege escalation steps within the system environment.
The operational impact of this vulnerability extends beyond simple file modification; it directly compromises both the integrity and availability of the affected systems. By altering file permissions on critical components such as SSH configurations, sudoers files, or application-specific state files, an attacker can lock out legitimate administrators, inject malicious code into trusted binaries via permission changes that allow writing to read-only paths, or disrupt service continuity by corrupting essential data structures. This leads to a degradation of system reliability and trustworthiness. In environments where cockpit-files is used for managing containerized applications or virtual machines, the impact could be amplified, potentially allowing an attacker to escape isolation boundaries if those containers rely on specific file permission models that are now subverted through this race condition.
Mitigation strategies must focus on eliminating the window of opportunity for such race conditions and enforcing strict security controls around privileged file operations. The most effective remediation involves refactoring the code to use secure temporary file creation practices, such as employing O_EXCL flags with open() calls or utilizing mkstemp functions that guarantee atomicity in file creation. Additionally, implementing mandatory access control policies like SELinux or AppArmor can restrict the ability of cockpit-files processes to modify arbitrary files regardless of race conditions. Regular auditing of privileged scripts and applications for TOCTOU vulnerabilities is essential, along with ensuring that all system components are updated to versions where this specific logic error has been corrected by the developers.