Cockpit: Local privilege escalation via ssh-add-public-key.sh (CVE-2026-91151)
A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper to perform unauthorized file operations.
CVE search metadata
CVE search record: CVE-2026-91151. Severity: high. CVSS: 7.3. KEV: no. Product: Cockpit. Brief: Cockpit: Local privilege escalation via ssh-add-public-key.sh (CVE-2026-91151). Brief link: https://feed.craftedsignal.io/briefs/2026-11-01-cockpit-privilege-escalation-cve-2026-91151/
Triage facts
Revision 1- Applicability
- Cockpit
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A flaw was found in the Cockpit administrative interface's ssh-add-public-key.sh helper script. A local authenticated user who controls a target account's home directory can trigger a privileged symlink dereference vulnerability.
Impact
When the ssh-add-public-key.sh helper runs with elevated privileges, it can be coerced into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows an attacker to arbitrarily change file ownership and modes, which may result in local privilege escalation and compromise the integrity, confidentiality, and availability of the system.