CVE-2026-91205

Executive Summary

CVE-2026-91205 is a TOCTOU (time-of-check-time-of-use) race condition in cockpit-files, a file management component of the Cockpit web-based server administration interface. A local unprivileged attacker who controls a writable parent directory can win a race window between directory creation with owner assignment and the subsequent chown operation, substituting a symbolic link for the newly created directory. This redirects the ownership change to an attacker-chosen file, potentially granting unauthorized read or write access to sensitive files. No patch currently exists from any tracked source, and no public proof-of-concept or exploit code is known at the time of writing.

Technical Analysis

Vulnerability Class

CVE-2026-91205 is classified under CWE-363: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The flaw is a classic symlink-based TOCTOU issue, a well-known sub-class of race condition vulnerabilities in privileged file-handling code.

Mechanism of the Flaw

The NVD description states that the vulnerability resides in cockpit-files during "directory creation with owner assignment." The vulnerable sequence of operations is:

1. A privileged or owner-elevated process (the Cockpit backend performing file operations) creates a new directory inside a parent directory.
2. The process then applies an ownership change (chown) to that newly created directory, presumably to set the intended owner of the folder.
3. Because the directory creation and the chown are performed as two separate operations, and because the parent directory is writable by the attacker, an attacker can intervene between steps 2 and 3.

The attacker replaces the just-created directory with a symbolic link pointing to an arbitrary target file. When the chown is subsequently applied, the operating system follows the symlink and changes ownership of the link target rather than the intended directory. This is the core symlink-following flaw: the ownership change is redirected to a file the attacker does not legitimately control.

Why the CVSS Vector Matters

The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N is instructive:

• AV:L (Local) — exploitation requires local presence; this is not remotely reachable.
• AC:H (High) — the attacker must win a timing window, making exploitation unreliable.
• PR:L (Low) — the attacker needs only low privileges (an unprivileged local account with write access to the parent directory).
• UI:R (Required) — some user interaction is required, consistent with an administrator or authorized user triggering the directory creation/ownership operation.
• S:U (Unchanged) — the exploit stays within the same security scope.
• C:H / I:H — high confidentiality and integrity impact, reflecting the ability to read or modify arbitrary sensitive files via redirected ownership.
• A:N — no availability impact is described.

The race window (AC:H) is the primary reason the overall base score sits at 6.0 rather than higher. Practically, a determined attacker on a local system can retry the attack repeatedly until the window is hit, which raises real-world exploitability above the theoretical "High" complexity would suggest.

Attack Surface

The attack surface is local and requires:

• A running Cockpit instance with cockpit-files handling directory creation with ownership assignment.
• An attacker with a local account and write access to a directory that the vulnerable component operates within.
• A user or process triggering the privileged directory-creation-with-chown operation.

No specific function names, file paths, or API endpoints are disclosed in the NVD description or CNA title, so those details cannot be enumerated with confidence. The analysis remains at the mechanism level as defined by the published description.

Exploitation Scenarios

1. Reconnaissance / Target Identification

The attacker needs a local foothold on a host running a vulnerable cockpit-files instance. The attacker enumerates directories they can write to that are also touched by the privileged file-management workflow — for example, shared or user-writable locations where the Cockpit process creates folders and subsequently applies ownership. The attacker identifies the timing relationship between directory creation and the ownership assignment.

2. Triggering the Race

The attacker sets up a tight loop that:

• Watches for the appearance of a newly created directory in the writable parent.
• Upon detection, removes that directory and immediately creates a symbolic link with the same name pointing to a target file of interest.

This is a classic symlink-swap race. The attacker does not need to defeat cryptographic controls — only to win a narrow timing window. Because the attacker can retry indefinitely, the effective success probability compounds over repeated attempts.

3. Redirecting the Ownership Change

When the privileged operation applies chown to the path it believes is the new directory, the kernel resolves the symlink and changes ownership of the target file instead. Depending on the target selected, this can:

• Grant the attacker's account ownership of a sensitive system or application file, enabling subsequent read (information disclosure) or write (unauthorized modification).

4. Post-Exploitation Impact

Once ownership of a sensitive file is redirected, the attacker can read configuration, credentials, or other protected data, or modify files to alter application or system behavior. This maps directly to the C:H / I:H subscores in the CVSS vector: high confidentiality and integrity impact. No availability (A:N) impact is described.

The presence of PR:L and AV:L means this is a local privilege-escalation / file-tampering primitive rather than a remote exploit. It is most dangerous on multi-user systems or where an attacker has a restricted local account on a management host.

Impact Assessment

Business Impact

Cockpit is a widely deployed web-based administration console for Linux servers. A local attacker on a managed host could leverage CVE-2026-91205 to tamper with protected files, potentially pivoting to broader system compromise. Because Cockpit is frequently used to administer servers, successful exploitation could undermine the integrity of the management plane on an affected host.

Affected Systems

Any host running a vulnerable cockpit-files version where an attacker obtains a local account and write access to a relevant parent directory. Specific affected version ranges are not published in the available data, so operators must treat all unpatched installations as potentially vulnerable until the vendor provides clarification.

Blast Radius

• Confidentiality (High): Redirection of ownership can expose sensitive files.
• Integrity (High): Ownership changes can enable unauthorized modification of protected files.
• Availability (None per CVSS): No availability impact described.
• Scope (Unchanged): The impact remains within the vulnerable component's security scope.

Exploitability Context

• EPSS: Not yet scored by FIRST.org — do not assume a predictive score.
• CISA KEV: Not listed.
• Public Exploit: None known.

The absence of a public PoC and KEV listing suggests low current exploitation activity, but the local, low-privilege nature of the flaw makes it attractive for post-compromise privilege escalation once a foothold exists.

Detection Guidance

Because no public exploit exists, the following detections focus on behavioral indicators of symlink-swap races and abnormal ownership changes.

Sigma Rule

title: Cockpit-Files Symlink Race Condition Ownership Redirection
id: 7f3c9a21-4e5b-4c8d-9a01-2b6d4f8e1c33
status: experimental
description: Detects potential exploitation of CVE-2026-91205 via rapid directory
  replacement and unexpected ownership changes on cockpit-files managed paths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91205
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_chown:
    type: 'SYSCALL'
    syscall: 'chown'
  selection_dir:
    type: 'PATH'
    name|contains: 'cockpit-files'
  condition: selection_chown and selection_dir
falsepositives:
  - Legitimate administrative ownership changes
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.91205

YARA Rule

rule CVE_2026_91205_Cockpit_Files_Symlink_Race
{
    meta:
        description = "Detects scripts or tooling attempting symlink swap races targeting cockpit-files directory ownership operations (CVE-2026-91205)"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91205"
        severity = "medium"

    strings:
        $s1 = "cockpit-files" ascii nocase
        $s2 = "symlink" ascii nocase
        $s3 = "chown" ascii nocase
        $s4 = "os.remove" ascii
        $s5 = "os.symlink" ascii
        $s6 = "inotify" ascii nocase
        $s7 = "TOCTOU" ascii nocase

    condition:
        (uint32(0) == 0x464c457f) or
        (
            filesize < 512KB and
            (
                ($s1 and $s2 and ($s3 or $s4)) or
                ($s1 and $s5) or
                ($s6 and $s5 and $s3)
            )
        )
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any ( \
  msg:"CVE-2026-91205 Potential Cockpit-Files Abuse - Suspicious File Operation Activity"; \
  flow:to_server,established; \
  content:"cockpit"; http_uri; nocase; \
  content:"files"; http_uri; nocase; \
  http.method; content:"POST"; \
  classtype:attempted-user; \
  sid:202691205; rev:1; \
  reference:cve,2026-91205; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; )

Note: Because this is a local file race condition, no reliable network signature exists. The above rule only flags adjacent HTTP activity against the Cockpit web interface and should be treated as low-fidelity context, not exploitation detection.

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and event.type == "start" and
process.name in ("chown", "chmod", "ln") and
process.parent.name in ("cockpit-files", "cockpit-bridge", "cockpit-ws") and
process.args : "*cockpit*"

Splunk SPL Query

index=linux_audit sourcetype=auditd syscall=chown
| where match(path, "cockpit") OR match(path, "cockpit-files")
| stats count min(_time) as firstTime max(_time) as lastTime by host, path, uid, auid
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
| table host, path, uid, auid, count, firstTime, lastTime

Wazuh OSSEC Rule

<group name="cockpit,cve-2026-91205,">
  <rule id="100912" level="10">
    <decoded_as>auditd</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">chown</field>
    <field name="audit.path">cockpit</field>
    <description>CVE-2026-91205: Potential symlink race ownership change on cockpit-files managed path</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. Vendor fix: N/A. Workarounds: N/A per tracked data.

1. Immediate Mitigations

• Restrict write access to directories that Cockpit file operations touch. If unprivileged users cannot write to the parent directory, the symlink-swap race cannot be performed.
• Minimize local untrusted accounts on hosts running Cockpit; reduce multi-user exposure.
• Audit Cockpit deployments to determine which hosts run cockpit-files and which local users have write access to relevant directories.
• Monitor ownership changes (chown) on sensitive files using the auditd/Sigma/Wazuh rules above as compensating detective controls.
• Consider mount options such as nosuid/nodev on writable partitions where CKockpit operates, and evaluate restricting symlink following in shared directories where feasible (e.g., via filesystem-level protections) as an interim hardening step — though baked-in mitigation should be validated against the specific environment.

2. Patch / Upgrade Steps

• No patch is currently available. Monitor the Cockpit project's official release channels and the NVD entry for CVE-2026-91205.
• When a fixed cockpit-files version is released, upgrade immediately and verify the fix addresses the chown/symlink TOCTOU sequence.
• Until then, treat affected hosts as unfixed and rely on access-control mitigations.

3. Long-Term Hardening

• Apply the principle of least privilege to directory permissions; avoid world-writable or broadly writable directories within management workflows.
• Use file operations that are atomic or that use O_NOFOLLOW/fchown on an opened descriptor rather than path-based operations — this is the correct class-level fix and should be requested from the maintainers.
• Regularly review Cockpit and cockpit-files release notes for security advisories.
• Integrate the detection rules above into SOC monitoring and tune for false positives.

References

1. NVD — CVE-2026-91205: https://nvd.nist.gov/vuln/detail/CVE-2026-91205
2. CWE-363 — Race Condition: https://cwe.mitre.org/data/definitions/363.html
3. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. Cockpit Project (vendor): https://cockpit-project.org/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-91205 is not currently listed.

Exploit-in-the-wild evidence: None observed. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing. EPSS has not yet assigned a score. All exploitation scenarios in this report are inferred from the vulnerability class and the NVD description; specific implementation details (function names, paths, endpoints) are not disclosed in available data and have not been fabricated.