VDB
CVE-2026-12423
CVE-2026-12423
PUBLISHED
CVSS 7.5 HIGH
Reported by redhat · Published October 1, 2026
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.12.0.23-1.el8sat |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.12.0.23-1.el9sat |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0.22-1.el9sat |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.16.0.25-1.el9sat |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.18.0.14-1.el9sat |
| Red Hat | Red Hat Satellite 6 | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.16.0.25-1.el9sat, 0:3.16.0.25-1.el9sat, 0:3.16.0.25-1.el9sat |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0.22-1.el9sat, 0:3.14.0.22-1.el9sat |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.12.0.23-1.el9sat, 0:3.12.0.23-1.el9sat, 0:3.12.0.23-1.el9sat |
| Red Hat | Red Hat Satellite 6 | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.18.0.14-1.el9sat, 0:3.18.0.14-1.el9sat, 0:3.18.0.14-1.el9sat |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.12.0.23-1.el8sat, 0:3.12.0.23-1.el8sat, 0:3.12.0.23-1.el8sat |
Timeline
- Oct 1, 2026 Coalition ESS Score
- Oct 1, 2026 CVE Published
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 2, 2026 EPSS Score
- Oct 3, 2026 EPSS Score
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Security Advisory
References
- RHSA-2026:74503 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:74504 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:74505 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:74506 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2488956 issue-trackingx_refsource_REDHAT
- http://www.openwall.com/lists/oss-security/2026/10/07/10 url