A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.
There is no complete mitigation available without a code fix. As a partial mitigation, administrators can restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and should carefully verify the Keyserver address shown in the "Edit Tang keyserver" dialog before clicking Save -- a value that does not resemble a well-formed hostname (for example, one starting with a hyphen) should not be accepted.