CVE-2026-91147

Executive Summary

CVE-2026-91147 is a denial-of-service vulnerability in cockpit-ws, the web service component of the Cockpit project. A remote, unauthenticated attacker can terminate the service by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash when WebService.UrlRoot is set. The result is unavailability of the Cockpit web service, impacting administrators who rely on it for system management. No public proof-of-concept, exploit code, or Nuclei template currently exists, and no vendor patch has been published.

Technical Analysis

CWE-617 (Reachable Assertion) is assigned to this issue. In the context of the Cockpit web service, the flaw manifests as follows: when the WebService.UrlRoot configuration directive is set to a non-default value, the service is expected to serve content under that URL prefix. Per the NVD description, a request made to the exact URL-root prefix without a trailing slash causes cockpit-ws to terminate unexpectedly.

The mechanism aligns with an assertion or invariant violation triggered during request routing or path-prefix matching. The service likely expects the URL-root string to resolve to a well-defined sub-path (with trailing slash) before handing off to downstream request handling. When the request matches the prefix exactly but omits the trailing slash, the routing logic reaches an unexpected state and the process aborts rather than returning an error response — this is characteristic of a fatal assertion or unchecked path condition (CWE-617).

The attack surface is the network-facing HTTP(S) listener of cockpit-ws — typically exposed on the administrative management port. Because the flaw is triggered before authentication (PR:N, no privileges required), the request does not need credentials, a session, or a valid user account. The attack complexity is rated High (AC:H), which suggests a precondition: the non-default WebService.UrlRoot configuration must be in place. Once that precondition is satisfied, triggering the crash requires only a single unauthenticated request — a very low operational cost for the attacker.

Specific internal function names, code paths, and parameter names are not available in the provided data; this analysis is deliberately constrained to the mechanism and vulnerability class as stated in the NVD description.

Exploitation Scenarios

No public proof-of-concept exists; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification An attacker scans for exposed Cockpit web service instances (commonly on the administrative web port, e.g., TCP/9090 in default deployments). The attacker identifies a target where WebService.UrlRoot has been configured to a non-default value (e.g., an organization hosting Cockpit under a sub-path rather than at the document root).

2. Trigger of the Specific Flaw Class The attacker issues a single HTTP request to the exact URL-root prefix configured in WebService.UrlRoot, deliberately omitting the trailing slash. For example, if the URL root is configured such that the service normally serves at a path ending in /, the attacker requests the prefix without that trailing /. Because cockpit-ws does not handle this boundary case, the process terminates.

3. Payload / Execution Method (vulnerability-class level) No exploit payload or crafted body is required — the crash is triggered purely by the shape of the request path. There is no memory corruption, no injection, and no code execution. This is a reachable-assertion / invariant violation: the request path itself is the "weapon."

4. Post-Exploitation Impact The service terminates unexpectedly, resulting in unavailability of the Cockpit web service for all legitimate users. If the service is not automatically supervised and restarted, administrators lose access to the management interface until the process is manually restarted. An attacker can repeat the request to sustain the outage, yielding a persistent denial-of-service condition. There is no confidentiality or integrity impact (C:N/I:N), only availability (A:H).

Impact Assessment

CVSS v3.1 base score is 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

• AV:N (Network): Remotely reachable; no adjacency required.
• AC:H (High): Requires the specific precondition of a configured WebService.UrlRoot and the exact prefix-without-slash request.
• PR:N (None): No privileges or credentials needed.
• UI:N (None): No user interaction required.
• S:U (Unchanged): Impact is confined to the vulnerable component.
• C:N / I:N / A:H: No confidentiality or integrity impact; high availability impact.

Business impact: Cockpit is a browser-based administrative interface used to manage Linux servers. An outage removes the primary management console for affected hosts, potentially delaying incident response, routine maintenance, and operational tooling that orchestrates tasks through Cockpit. The blast radius is limited to hosts where WebService.UrlRoot is set to a non-default value and where the service is externally reachable and not auto-restarted. Internet-exposed Cockpit instances are the highest-risk population. EPSS is not yet scored by FIRST.org; no malware or ransomware associations are known.

Detection Guidance

Sigma Rule

title: Cockpit WebService UrlRoot Without Trailing Slash DoS Attempt
id: 3f9c1b2a-7d4e-4a11-9b6c-0e2f5a8d9c10
status: experimental
description: Detects requests to the configured WebService.UrlRoot prefix without a trailing slash that can terminate cockpit-ws (CVE-2026-91147)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91147
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: cockpit
detection:
  selection_method:
    cs-method: 'GET'
  selection_path:
    cs-uri-stem|endswith:
      - '/cockpit'
      - '/cockpit-ws'
  filter_trailing_slash:
    cs-uri-stem|endswith: '/'
  condition: selection_method and selection_path and not filter_trailing_slash
falsepositives:
  - Legitimate clients redirected from the bare prefix
level: medium
tags:
  - attack.t1499
  - cve.2026.91147

YARA Rule

rule CVE_2026_91147_Cockpit_UrlRoot_DoS_Request
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP request lines targeting a cockpit-ws UrlRoot prefix without trailing slash (CVE-2026-91147)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91147"
        date = "2026-01-01"
        cve = "CVE-2026-91147"

    strings:
        $req = "GET /cockpit" ascii nocase
        $req2 = "GET /cockpit-ws" ascii nocase
        $host = "Host:" ascii nocase
        $badslash = "/ HTTP/1." ascii

    condition:
        ($req or $req2) and $host and $badslash
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91147 Cockpit UrlRoot Without Trailing Slash DoS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cockpit"; http.uri; content:!"/"; reference:cve,2026-91147; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91147; classtype:attempted-dos; sid:202691147; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ http where http.request.method == "GET" and endsWith(http.request.path, "/cockpit") ]

Splunk SPL Query

index=web sourcetype=cockpit OR sourcetype=access_combined
| eval path=coalesce(uri_path, url, cs_uri_stem)
| where match(path, "(?i)^/cockpit(-ws)?$")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, path
| where count >= 1

Wazuh OSSEC Rule

<group name="web,cockpit,">
  <rule id="100911" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.+/cockpit(-ws)?$</field>
    <description>CVE-2026-91147: Cockpit UrlRoot request without trailing slash (DoS attempt)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_91147,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence, vendor fix, or official workaround exists in any tracked source.

1. Immediate mitigations

   • Ensure WebService.UrlRoot is either left at its default or that clients always target the prefix with a trailing slash (defense via reverse proxy rewrite that appends the slash).
   • Place cockpit-ws behind an authenticating reverse proxy and restrict network reachability to trusted management networks/VPNs only.
   • Configure process supervision (e.g., systemd Restart=always) so the service auto-recovers after an unexpected termination.
   • Add a reverse-proxy rule that normalizes requests matching the exact URL-root prefix to include a trailing slash before forwarding.

2. Patch / upgrade steps

   • No vendor patch is currently available. Monitor the Cockpit project release channels and the NVD entry for CVE-2026-91147. When a fixed release is published, upgrade cockpit-ws immediately and validate the WebService.UrlRoot behavior.

3. Long-term hardening

   • Never expose the Cockpit management interface directly to the internet; require VPN or zero-trust access.
   • Continuously monitor for available updates and subscribe to the Cockpit security advisories.
   • Add the detection rules above to SOC monitoring to alert on any request matching the vulnerable pattern.

References

1. NVD — CVE-2026-91147: https://nvd.nist.gov/vuln/detail/CVE-2026-91147
2. CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
3. Cockpit Project: https://cockpit-project.org/
4. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91147 is NOT listed — no exploit-in-the-wild evidence): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor note: No known threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-91147 at this time. No public PoC, exploit code, or Nuclei template exists.