CVE-2026-91202

Executive Summary

CVE-2026-91202 is a symlink-following vulnerability (CWE-61) in cockpit-files, the file management component of the Cockpit web-based server administration interface. A low-privileged local user can craft a directory containing a symbolic link and then invoke the privileged "Paste as owner" function, causing arbitrary file ownership changes outside the intended destination directory. The impact is primarily data integrity compromise (CVSS I:H), with potential confidentiality loss where newly assigned ownership grants unintended read access. Exploitation requires user interaction (a privileged operator must select a non-original owner during paste), and no public PoC, exploit code, or Nuclei template currently exists.

Technical Analysis

Vulnerability class: CWE-61 (UNIX Symbolic Link Following). This is a TOCTOU-adjacent class of flaw in which a privileged file operation trusts a path — a directory entry — that an unprivileged actor can influence via a symlink, causing the privileged operation to act on a target outside the intended scope.

Root cause mechanism (derived strictly from the NVD description): Cockpit's privileged file operations run with elevated privileges (Cockpit's architecture uses a privileged helper invoked over the system D-Bus by the unprivileged cockpit-ws/cockpit-bridge session). The "Paste as owner" feature performs a copy/paste operation and then applies a chosen owner to the pasted content — an operation requiring root/CAP_CHOWN. The description states that the flaw allows "arbitrary file ownership changes outside the intended pasted directory."

The attack primitive:

1. A low-privileged local user creates a directory containing a symbolic link.
2. When the privileged "Paste as owner" function processes that directory, the symlink target — not the directory entry's apparent path — is resolved by the privileged operation.
3. The ownership-change (chown) operation is therefore applied to the symlink's target file, which may reside outside the intended pasted directory.
4. Because the operation runs privileged, it can change ownership of files the low-privileged user could not otherwise modify.

Why this works: The privileged paste routine evidently does not use O_NOFOLLOW-equivalent semantics, does not resolve and validate each path element against an allowed root, and does not perform a post-resolution containment check (e.g., confirming the realpath of each entry remains within the paste destination). This is the canonical symlink-following failure: canonicalize-then-act is not performed, or is performed without rejecting symlinked entries.

Attack surface: Local. The attack surface is the file-paste code path within cockpit-files, specifically the branch that handles owner reassignment during paste. The precondition is that a privileged user (or any user operating the privileged helper) pastes attacker-influenced content.

Important accuracy note: The NVD description and this dataset do not disclose specific function names, method signatures, D-Bus method names, file paths, or parameter identifiers. No code-level identifiers are reproduced here; any that appear in third-party write-ups should be treated as unverified until a vendor advisory is published.

CVSS interpretation (6.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L):

• AV:L — attacker needs local access (not network-reachable).
• AC:L — no special conditions beyond the local setup.
• PR:L — low privileges are sufficient for the attacker to plant the malicious directory/symlink.
• UI:R — a separate privileged user must perform the paste and select a non-original owner; this is the key attenuation of severity.
• S:U — impact remains within the same security authority (unchanged).
• C:L / I:H / A:L — confidentiality is affected only conditionally ("in some cases"), integrity is the primary casualty, availability is minimally affected.

The PR:L + UI:R combination is what keeps this from scoring as a critical privilege-escalation issue: the attacker cannot trigger the bug alone.

Exploitation Scenarios

No public PoC exists. The chain below is inferred strictly from the vulnerability class and the NVD description; no implementation-specific details are fabricated.

1) Reconnaissance / target identification The attacker has low-privileged local access to a host running Cockpit with the cockpit-files module. They enumerate the local filesystem to identify:

• A directory location writable by their unprivileged account.
• The paths of files whose ownership they wish to change, for which they lack write/chown rights.
• Whether a privileged operator (or an automated job) is likely to perform paste operations on their content.

2) Triggering the specific flaw class The attacker builds a directory tree that includes a symbolic link. The symlink points to a file outside the intended paste destination — for example a sensitive file the attacker wants to read or whose integrity they want to affect. When the privileged "Paste as owner" routine enumerates and acts on the attacker-influenced directory, the symlink is followed and the chown is applied to the link target rather than to a contained file.

3) Payload / execution method at the class level There is no code-execution payload. The "payload" is the crafted directory containing the symlink, combined with the privileged paste action. The exploit succeeds only if:

• a privileged user initiates the paste of attacker-controlled content, and
• that operator selects an owner different from the file's original owner (per the description: "Exploitation requires user interaction to select a non-original owner during the paste operation").

The UI:R subscore confirms that the attack cannot complete without this human step.

4) Post-exploitation impact

• Integrity (high): Ownership of arbitrary files outside the paste destination can be reassigned. Ownership reassignment can grant the attacker (or a chosen account)write control over files, enabling tampering with configuration, scripts, or data whose integrity the attacker should not control.
• Confidentiality (low/conditional): If the new owner is an account the attacker controls (or if ownership changes cause group/other permission semantics to shift), unauthorized read access to protected content may result — described explicitly as "in some cases."
• Availability (low): Ownership changes can break services that rely on expected ownership of their files.

Detection opportunity: Because this is a local, human-in-the-loop file-operation bug, network-level detection is weak. Detection is primarily host-based: audit the privileged chown operations, watching for ownership changes on files that were not part of the paste destination and for chown events immediately following paste operations. See Detection Guidance.

Impact Assessment

Affected systems are any host running Cockpit with the cockpit-files module and exposing the "Paste as owner" capability.

• Blast radius: Scoped to a single host per exploitation, but highly sensitive because Cockpit typically administers production servers, and ownership changes to critical files can undermine the integrity guarantees the admin relies on.
• Business impact: Data integrity compromise ("compromise of data integrity" per the description); possible unauthorized disclosure; possible service disruption due to unexpected ownership.
• Attack prerequisites: Low-privileged local presence, ability to create a directory with a symlink, and a privileged user's paste action selecting a non-original owner. This combination makes mass, remote, unauthenticated exploitation infeasible.
• CVSS subscores of record: C:L / I:H / A:L, S:U, base 6.1 (Medium). The elevated integrity subscore is the driving factor; the UI:R requirement holds the overall score below High.
• Exploit maturity: None. No PoC, no exploit code, no Nuclei template, not in CISA KEV.

Detection Guidance

Environment note: because this is a local, host-side, UI-gated file-operation vulnerability, network IDS coverage is inherently partial. Host audit rules (auditd/Wazuh) and file-ownership telemetry provide the strongest detection. The rules below are written against the behavioral signatures implied by the description (privileged chown following a paste) and are intended as starting points to be tuned to your environment.

Sigma Rule

title: Privileged File Ownership Change Following Paste Operation (Cockpit cockpit-files Symlink Following)
id: 8f3a2c1e-7d4b-4a9f-9c2e-3b5e6f1a0d21
status: experimental
description: Detects privileged chown operations consistent with abuse of the Cockpit "Paste as owner" function following a symlinked directory, per CVE-2026-91202 (CWE-61).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91202
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1548
  - attack.t1044
logsource:
  product: linux
  service: auditd
detection:
  selection_chown:
    type: 'SYSCALL'
    syscall|contains:
      - 'chown'
      - 'fchownat'
      - 'lchown'
  selection_priv:
    exe|endswith:
      - '/cockpit-bridge'
      - '/cockpit-ws'
  selection_uid:
    uid: 0
  filter_expected_paths:
    name|startswith:
      - '/var/lib/cockpit/'
      - '/home/'
  condition: selection_chown and selection_priv and selection_uid and not filter_expected_paths
level: medium
fields:
  - exe
  - name
  - uid
  - auid
falsepositives:
  - Legitimate administrative ownership changes initiated by a genuine Cockpit administrator on in-scope paths.

YARA Rule

rule Cockpit_Files_Symlink_Paste_Ownership_CVE_2026_91202
{
    meta:
        author      = "valtersit.com"
        description = "Heuristic detection of symlink artifacts plausibly associated with CVE-2026-91202 abuse in cockpit-files paste staging areas. Low-confidence; tune to environment."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-91202"
        cve         = "CVE-2026-91202"
        date        = "2026-01-01"

    strings:
        $cockpit = "cockpit" ascii nocase
        $paste   = "paste" ascii nocase
        $owner   = "owner" ascii nocase

    condition:
        // Symlinks are not directly matchable by YARA; this rule targets
        // staging/manifest files left behind by paste workflows.
        2 of ($cockpit, $paste, $owner) and filesize < 64KB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 9090 ( \
  msg:"CVE-2026-91202 Possible Cockpit cockpit-files Paste-as-owner Abuse (symlink following)"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.uri; content:"/cockpit"; nocase; \
  http.header; content:"Cookie"; nocase; \
  classtype:attempted-admin; \
  reference:cve,2026-91202; \
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-91202; \
  metadata:service http; \
  sid:9120201; rev:1; )

This is a coarse network-side indicator only. The true exploitation is local; the POST to the Cockpit web port is used here solely as an interactive-session marker and will produce false positives in normal Cockpit usage.

Elastic Detection

process where event.action == "exec" and
  process.name in ("chown", "cockpit-bridge", "cockpit-ws") and
  process.args : ("*--owner*", "*Paste*") and
  user.id == "0"

Alternative audit-based EQL (preferred if auditd shipping is enabled):

process where event.category == "process" and
  process.name == "cockpit-bridge" and
  process.parent.name != null and
  wildcard(process.args, "*paste*", case_insensitive=true)

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=linux_audit
| search (type=SYSCALL syscall=chown OR syscall=fchownat OR syscall=lchown)
| rex field=_raw "exe=\"(?P<exe>[^\"]+)\""
| search exe IN ("/usr/libexec/cockpit-bridge","/usr/lib/cockpit/cockpit-bridge","/usr/bin/cockpit-bridge","/usr/libexec/cockpit-ws")
| rex field=_raw "name=\"(?P<target>[^\"]+)\""
| where NOT match(target, "^/(var/lib/cockpit|home)/")
| stats count min(_time) as first_seen max(_time) as last_seen values(target) as files by host, exe, uid, auid
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="cockpit,cve-2026-91202,">
  <rule id="912020" level="10">
    <decoded_as>json</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">chown|fchownat|lchown</field>
    <field name="audit.exe">cockpit-bridge|cockpit-ws</field>
    <description>CVE-2026-91202: Possible privileged ownership change via Cockpit cockpit-files paste-as-owner (symlink following).</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Signature wording is aligned to the dataset provided. No vendor fix, workaround, or affected-version list exists in the source data, so no version-based tuning is possible at this time.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source (no vendor fix, no workaround, no affected-version list, no OSV packages). Treat as unpatched until a vendor advisory confirms otherwise.

1) Immediate mitigations (until a patch exists):

• Disable or restrict the "Paste as owner" capability in cockpit-files if your deployment permits, or restrict which privileged users may operate Cockpit on sensitive hosts.
• Restrict Cockpit exposure: Limit who can log into Cockpit and from where (bind to localhost, reverse-proxy with strong auth, and place behind network controls). Though this CVE is local, reducing the privileged-user population reduces the UI:R trigger surface.
• Principle of least privilege for local accounts: Ensure low-privileged users cannot write to directories that a privileged user is likely to paste into. Avoid shared paste staging directories.
• Monitor privileged ownership changes using the host-audit detections above; alert on chown events outside expected paths.
• Educate administrators not to select a non-original owner when pasting untrusted content — the human step is the final gate the attacker cannot bypass.

2) Patch / upgrade steps:

• No fixed version is known. Monitor the Cockpit project's release notes / advisory channels and apply the official fix as soon as it is published.
• Until then, apply the configuration and monitoring mitigations above.

3) Long-term hardening:

• Audit privileged file-management helpers for symlink-following safety: require symlink resolution (realpath) followed by containment validation against the intended root before costly privileged operations (chown/chmod), or operate with no-follow semantics.
• Adopt capability-scoped, path-validated privileged helpers rather than broad root file operations.
• Add regression tests for symlink-following in privileged copy/paste code paths.

References

1. NVD — CVE-2026-91202: https://nvd.nist.gov/vuln/detail/CVE-2026-91202 (primary data source for this report)
2. CWE-61 — UNIX Symbolic Link (Symlink) Following: https://cwe.mitre.org/data/definitions/61.html
3. FIRST.org EPSS — Not yet scored; no EPSS value available at time of writing.
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-91202 is NOT listed (confirmed as of report date).
5. Cockpit project (vendor) documentation and release notes: https://cockpit-project.org/ (no advisory for this CVE confirmed in tracked sources)

Threat actor / exploit-in-the-wild evidence: None. No PoC, no exploit code, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-91202 in the provided dataset. There is no evidence of active exploitation.

Report prepared by valtersit.com. All technical claims are constrained to the CVE intelligence data provided. No code-level identifiers, endpoints, or version ranges are reproduced that were not present in the source description; such details remain "insufficient technical detail available" pending a vendor advisory or CVE update.