7.5Hoch
CVE-2026-12423Foreman: unauthenticated information disclosure via provisioning token validation flaw
Beschreibung
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
Schwachstellentyp (CWE):
CWE-306
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | all versions | |
| redhat | satellite | 6.16 – < 6.16.4 | |
| satellite | 6.16 | — | |
| satellite | 6.17 | — | |
| satellite | 6.18 | — | |
| satellite | 6.19 | — | |
| satellite capsule | 6.16 | — | |
| satellite capsule | 6.17 | — | |
| satellite capsule | 6.18 | — | |
| satellite capsule | 6.19 | — | |
| satellite utils | 6.16 | — | |
| satellite utils | 6.17 | — | |
| satellite utils | 6.18 | — | |
| satellite utils | 6.19 | — | |
| theforeman | foreman | — |
Referenzen und Patches
- RHSA-2026:74503 vendor-advisoryVendor Advisory
- RHSA-2026:74504 vendor-advisoryVendor Advisory
- RHSA-2026:74505 vendor-advisoryVendor Advisory
- RHSA-2026:74506 vendor-advisoryVendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-12423 vdb-entryVendor Advisory
- RHBZ#2488956 issue-trackingIssue TrackingVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/07/10 Third Party Advisory
CPE-Treffer (NVD) (6)
cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.16 < 6.16.4cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.17 < 6.17.12cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.5cpe:2.3:a:theforeman:foreman:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.18 < 6.18.10cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*