CVE-2026-91149

Executive Summary

CVE-2026-91149 is an unauthenticated denial-of-service vulnerability in the Cockpit web-based server administration interface. By opening and sustaining many simultaneous connections to the cockpit-tls service, an unauthenticated remote attacker can force the service to spawn an unbounded number of detached threads, exhausting memory and file descriptors and rendering Cockpit unavailable to legitimate administrators. The flaw is rated CVSS 3.1 base score 7.5 (High) with a full Availability impact (A:H) and no confidentiality or integrity impact, and no patch, workaround, or public exploit code has been identified at the time of writing.

Technical Analysis

The vulnerability class is CWE-770: Allocation of Resources Without Limits or Throttling. The affected component is the cockpit-tls service, which fronts the Cockpit administration interface and terminates TLS connections before handing them off to the core Cockpit process.

Per the NVD description, the exact defect is a lack of bounding on detached thread creation. When an incoming connection reaches cockpit-tls, the service creates a detached thread to handle that connection. The service does not enforce a cap on the total number of concurrently handled connections, nor does it appear to bound how many threads may be spawned or how long a half-open/slow connection may be kept alive. A detached thread — by definition in POSIX threading — cannot be joined and its resources (stack memory, thread descriptor, associated kernel structures) are reclaimed only when the thread completes execution. If an attacker drives the service to keep many handling threads alive simultaneously, those resources accumulate.

Two resource pressures arise directly from the described behavior:

1. Memory exhaustion. Each thread carries its own stack allocation. Thousands of concurrent, long-lived handling threads multiply stack and per-thread heap allocations, driving up resident memory until the process (or the host) is starved.
2. File descriptor exhaustion. Each live connection consumes a socket file descriptor. Since threads are spawned per connection, sustained connections deplete the process and system file-descriptor tables, after which cockpit-tls can no longer accept() new connections or perform routine I/O.

The critical property is that this requires no authentication whatsoever (PR:N, UI:N). An attacker does not need credentials, a session, or a user interaction — only network reachability to the Cockpit TLS endpoint. The attack is remotely triggerable (AV:N) and has low complexity (AC:L), meaning it can be scripted trivially.

The "detached thread" mechanic is important for defenders: because these threads are detached, there is no parent waiting to pthread_join() them and no natural back-pressure mechanism releasing resources when the attacker's connection is still nominally open. The service is only relieved when the connections are torn down, which the attacker controls.

This is a classic resource-exhaustion / asymmetric DoS: the cost to the attacker (a handful of open sockets) is far lower than the cost to the defender (memory, file descriptors, loss of a management plane).

No specific function names, endpoints, or parameter names beyond the cockpit-tls service name are provided in the source data, so no code-level identifiers are asserted here. The mechanism is described at the vulnerability-class level consistent with the NVD description.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-91149. The following attack chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker scans for hosts exposing the Cockpit web interface on its default TCP port 9090. Surfaces such as the login page title or the Cockpit login HTML fingerprint identify candidate targets. Because the endpoint is unauthenticated at the connection layer, the attacker does not need to attempt logins; simply confirming the TLS service is accepting connections is sufficient.

2. Triggering the flaw class. The attacker opens a large number of simultaneous TCP/TLS connections to the cockpit-tls service and sustains them — that is, the attacker does not complete and close the handshake/request cycle but holds connections open. This is the key to unbounded thread creation: each held connection corresponds to a detached thread that remains alive. A low-rate, long-lived connection pattern (slow connections, long timeouts) is precisely what converts open sockets into retained threads.

3. Payload / execution method (vulnerability-class level). No malicious payload is required. The "payload" is the raw set of concurrent, sustained connections. The attacker need not exploit a memory-corruption primitive, inject code, or bypass authentication — the mere act of holding connections causes the service to allocate a thread per connection without a limit. The attack is therefore a denial-of-service in the purest sense.

4. Post-exploitation impact. As threads and descriptors accumulate, the service degrades and then fails: new connection attempts are refused, legitimate administrators cannot reach the Cockpit login page, and existing management sessions may be interrupted. On resource-constrained hosts, exhaustion of file descriptors may also degrade other services sharing the system limits. There is no lateral movement, credential theft, or data exfiltration associated with this flaw — the impact is confined to availability (C:N/I:N/A:H). Recovery typically requires terminating the malicious connections and/or restarting the cockpit-tls service.

Note: this chain is a class-level reconstruction. No specific request format, query string, or API call is asserted because none is provided in the source data.

Impact Assessment

Confidentiality: None (C:N). The flaw does not disclose data. Integrity: None (I:N). The flaw does not modify data. Availability: High (A:H). Complete loss of the Cockpit management interface is achievable. Scope: Unchanged (S:U) — the impact remains within the vulnerable service's security authority, though resource exhaustion can spill over onto host-wide limits.

Base score: 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Business impact. Cockpit is the web administration console for Linux servers, commonly used on RHEL-family, Fedora, Debian/Ubuntu, and similar systems to manage storage, networking, containers, services, and logs. Losing Cockpit means administrators lose their browser-based management plane for potentially large fleets. If an attacker positions this attack during an incident, they simultaneously deny the defender an important remediation and visibility tool.

Blast radius. Any host exposing cockpit-tls to an untrusted network is a candidate. The attack does not affect the whole fleet simultaneously unless many hosts are targeted, but within a single host the availability impact can be total. Hosts with low file-descriptor or memory limits reach degradation fastest. Because the attack needs only connectivity and no credentials, any internet- or VPN-reachable Cockpit instance is a credible target.

EPSS: Not yet scored by FIRST.org; no EPSS value is asserted. CISA KEV: No — not known to be exploited in the wild, though the low-complexity, unauthenticated nature of the bug makes weaponization straightforward.

Detection Guidance

Detection for a thread/file-descriptor exhaustion attack is best approached through host resource telemetry correlated with connection counts. The rules below are tuned to the behavioral signature: many concurrent connections and rapidly growing thread/FD counts on the cockpit-tls service.

Sigma Rule

title: Cockpit cockpit-tls Thread and File Descriptor Exhaustion DoS Attempt
id: 9a4e6f2c-7b21-4d88-9c3e-1f0a2d5b6e77
status: experimental
description: Detects abnormal growth in thread count for the cockpit-tls service, consistent with CVE-2026-91149 resource exhaustion via numerous simultaneous connections.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91149
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
  - attack.impact
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/cockpit-tls'
  selection_thresholds:
    CommandLine|contains:
      - 'cockpit-tls'
  condition: selection_proc
  # Correlate with host thread-count telemetry emitted by auditd/EDR;
  # alert when cockpit-tls thread count exceeds baseline (e.g. > 500).
falsepositives:
  - Legitimate high-connection periods during large batch administrative operations
level: medium

YARA Rule

rule CVE_2026_91149_Cockpit_TLS_DoS_Artifacts
{
    meta:
        description = "Detects Cockpit cockpit-tls service binary/strings relevant to CVE-2026-91149 thread exhaustion monitoring"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91149"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $svc1 = "cockpit-tls" ascii wide nocase
        $svc2 = "cockpit-tls" ascii
        $thr1 = "pthread_create" ascii
        $thr2 = "pthread_detach" ascii
        $det  = "detach" ascii nocase

    condition:
        (uint32(0) == 0x464c457f) and    // ELF binary
        ($svc1 or $svc2) and
        ($thr1 or $thr2) and
        $det
}

Suricata IDS Rule

alert tcp any any -> any 9090 ( \
  msg:"CVE-2026-91149 Possible Cockpit cockpit-tls Connection Flood (DoS)"; \
  flow:to_server,established; \
  flags:S; \
  threshold:type both, track by_src, count 100, seconds 10; \
  classtype:attempted-dos; \
  sid:202691149; \
  rev:1; \
  metadata:reference nvd,cve CVE-2026-91149; \
)

Elastic Detection

process where process.name == "cockpit-tls"
and process.thread.count > 500

Correlation note: pair this process/thread-count threshold with network where destination.port == 9090 and event.action == "connection_accepted" grouped by source IP to attribute the exhaustion to a single remote origin.

Splunk SPL Query

index=os host=* sourcetype=host_metrics process_name=cockpit-tls
| stats latest(thread_count) as threads, latest(open_fds) as fds by host
| where threads > 500 OR fds > 4000
| table host threads fds

Correlate with a connection-source view:

index=netflow dest_port=9090
| stats count by src_ip dest_ip
| where count > 200
| sort - count

Wazuh OSSEC Rule

<group name="cockpit,cve-2026-91149,denial_of_service">
  <rule id="202691149" level="10" frequency="1" timeframe="60">
    <if_matched_sid>5501</if_matched_sid>
    <match>cockpit-tls</match>
    <description>CVE-2026-91149: Possible cockpit-tls resource exhaustion (excessive threads/connections)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch source, vendor advisory fix, or fixed version has been identified by any tracked source. There is no official Vendor Fix and no official Workaround. The following measures are defensive hardening and interim containment only.

1. Immediate mitigations.

• Restrict network exposure of cockpit-tls (default TCP 9090) using a firewall or security group so that only trusted management networks/VPNs can reach it. This eliminates the unauthenticated-remote attack precondition (AV:N).
• Place Cockpit behind a rate-limiting or connection-limiting reverse proxy that caps concurrent connections and enforces connection timeouts per source IP.
• Apply per-service resource ceilings where supported (systemd TasksMax, LimitNOFILE, MemoryMax) to the cockpit-tls unit so exhaustion is bounded and does not take down the host.
• Configure short TLS handshake/connection idle timeouts to reduce the ability to "sustain" connections.
• Monitor for the resource-growth signature and alert at a threshold well below exhaustion.

2. Patch / upgrade steps.

• Track the Cockpit upstream project and the distribution vendor advisories (RHEL, Fedora, Debian, Ubuntu) for a fix that bounds concurrent connection handling in cockpit-tls.
• When a fixed build is published, patch hosts and confirm cockpit-tls is restarted. Until then, treat the issue as open.
• Since affected-version data is unavailable, verify exposure by inspecting whether the installed Cockpit includes the cockpit-tls component and whether it is network-reachable.

3. Long-term hardening.

• Adopt an architecture in which management interfaces such as Cockpit are never directly exposed to untrusted networks.
• Enforce resource quotas and file-descriptor ceilings for all externally reachable service units as a default.
• Add availability-focused monitoring and capacity alerting so that thread/FD growth is caught before it becomes an outage.
• Include resource-exhaustion DoS scenarios (CWE-770) in threat modeling for management-plane services, since their loss is both an availability event and a loss of remediation capability.

References

1. NVD — CVE-2026-91149: https://nvd.nist.gov/vuln/detail/CVE-2026-91149
2. CWE-770: Allocation of Resources Without Limits or Throttling — https://cwe.mitre.org/data/definitions/770.html
3. Cockpit project homepage and documentation — https://cockpit-project.org/
4. MITRE ATT&CK T1499 — Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
5. FIRST EPSS (CVE-2026-91149 currently unscored) — https://www.first.org/epss/

Threat actor / exploitation status: No exploit code, PoC, Nuclei template, or in-the-wild exploitation evidence identified. CISA KEV: No. Public PoC status: None. All exploitation detail in this report is inferred from the vulnerability class (CWE-770) and the NVD description; no implementation specifics beyond the cockpit-tls service name have been asserted.