Cockpit 9.8 injection flaw: 6,767 fingerprints, 10,146 title matches

CVE-2026-4631 is a command injection in Cockpit's remote login feature rated 9.8 under CVSS 3.1: unvalidated hostnames and usernames let a single HTTP request execute code without credentials. ZoomEye scans on 27 October 2026 found 6,767 application fingerprints and 10,146 page-title matches.

• CVE-2026-4631 is command injection in Cockpit remote login, CVSS 3.1 score 9.8
• A single HTTP request to the login endpoint executes code without credentials
• ZoomEye: 6,767 Cockpit fingerprints vs 10,146 title matches
• Cockpit typically listens on port 9090 and is often hidden behind VPN or SSH