Red Hat Patches Two Lodash Flaws in Subscription Manager Cockpit on Enterprise Linux 10
Red Hat issued security advisory RHSA-2026:97090 on 10 November 2026, covering the subscription-manager-cockpit package on Red Hat Enterprise Linux 10. The update resolves two vulnerabilities in lodash, the JavaScript utility library bundled with the Subscription Manager Cockpit user interface. The first, CVE-2026-4800, is described as arbitrary code execution through untrusted input passed into lodash template imports. The second, CVE-2026-2950, is a prototype pollution weakness that allows deletion of built-in prototype properties by way of an array path bypass. Red Hat rates the combined impact as Important and ships the fix in subscription-manager-cockpit-17-1.el10 along with rhsm-icons-17-1.el10, built for x86_64, s390x, ppc64le and aarch64 variants of RHEL 10.
The advisory does not publish exploitation details, proof-of-concept code or an attack narrative for either flaw, and Red Hat points readers to the individual CVE pages for CVSS scoring and impact analysis. What the advisory does establish is the affected component and the route to it: the vulnerable lodash code sits inside the Subscription Manager Cockpit UI, a web-based management plugin that administrators use through the Cockpit console rather than a background daemon. Template-based code execution issues of the CVE-2026-4800 type typically require attacker-influenced data to reach a templating call, while prototype pollution of the CVE-2026-2950 type manipulates shared JavaScript object behaviour rather than executing code directly. Neither CVE is described in the advisory as having been seen in use against Red Hat customers. Both are corrected in the same package rebuild, with no configuration workaround offered as an alternative.
Cockpit is a privileged administrative surface. The subscription-manager plugin is presented to users who are already managing entitlements and host configuration, so any flaw that lets untrusted content influence that interface sits uncomfortably close to host-level administration. The exposure is broad in count rather than deep in individual risk, because subscription-manager-cockpit is a standard part of many RHEL 10 estates across all four supported architectures, and fleet owners will find the package present on build images and golden templates as well as running hosts. On current exploitation evidence the pressure is low: FIRST EPSS places CVE-2026-4800 at a 2.8 percent probability of exploitation in the next 30 days, and CVE-2026-2950 at 0.3 percent. Neither CVE appears in a confirmed in-the-wild campaign in the material available, and the fixed packages were published at the same time as the disclosure, which keeps this in the scheduled maintenance category rather than the incident queue.
Attack Surface
Web Application, System Management Service, Supply Chain (Third-party vendors)
Tactics
Execution, Initial Access
Techniques
- T1190 – Exploit Public-Facing Application
- T1059.007 – Command and Scripting Interpreter: JavaScript
- T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools
SuperPRO's Threat Countermeasures Procedures
- Update to subscription-manager-cockpit-17-1.el10 and rhsm-icons-17-1.el10 on all Red Hat Enterprise Linux 10 hosts (x86_64, s390x, ppc64le, aarch64) using dnf update subscription-manager-cockpit rhsm-icons, per RHSA-2026:97090.
- Validate the installed artefacts against the advisory hashes before rollout: subscription-manager-cockpit-17-1.el10.noarch.rpm SHA-256 c0bc057553a0d5bf5fa9d380942965e4f26f97e6e57a09ff788bd525f02cc4fd and rhsm-icons-17-1.el10.noarch.rpm SHA-256 c9bb6b1acb7e43aa5bcff6d105e937ad54073ed120e48fc6cf07c45f79b96ebc.
- Inventory exposure with rpm -q subscription-manager-cockpit across the estate, and use the Red Hat Lightspeed patch analysis view linked from RHSA-2026:97090 to list systems still reporting the advisory as applicable.
- On RHEL 10 hosts that do not require browser-based management, remove the attack surface entirely with systemctl disable –now cockpit.socket until the updated package is deployed.
- Where Cockpit must remain available, restrict it to a dedicated management network using firewalld rich rules so the console is unreachable from general user VLANs and the internet.
- Rebuild RHEL 10 golden images, kickstart trees and container base layers that embed subscription-manager-cockpit, so newly provisioned hosts do not reintroduce the pre-17-1.el10 lodash code.
- Search the wider estate for other software shipping bundled lodash and check it against CVE-2026-4800 and CVE-2026-2950, since the subscription-manager-cockpit rebuild only corrects the copy inside that package.
