{"id":"CVE-2026-113496","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-113496","generatedAt":"2026-10-28T08:11:29.572Z","title":"A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings.","description":"A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.","published":"2026-10-20T12:17:30.000Z","lastModified":"2026-10-20T15:04:00.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"},"cwe":["CWE-214"],"affected":[],"epss":{"score":0.00143,"percentile":0.03576,"date":"2026-10-27","history":[{"date":"2026-10-21","score":0.00143,"percentile":0.03265}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-20T12:17:30.000Z","detail":{"score":"5.0","severity":"MEDIUM","publishedAt":"2026-10-20T12:17:29.763Z"},"summary":"New CVE, medium severity (CVSS 5.0)."}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-113496","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556058","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-113496","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}