CVE-2026-106471
Received Received - Intake

Authorization Bypass in Candlepin via @Verify Annotation

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: redhat-SADP

Description
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-106471
EUVD
EUVD-2026-94155

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat candlepin *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Candlepin, a Red Hat component. The authorization filter incorrectly grants access when multiple parameters are annotated with @Verify. Instead of requiring access to every verified entity, it only needs access to one. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. This allows unauthorized disclosure of consumer information and modification of entitlements and subscription resources, even across organizations.

Detection Guidance

To detect this vulnerability, review Candlepin logs for unauthorized access attempts or successful operations on resources where authorization should have failed. Check REST API endpoints with multiple @Verify annotations for improper access grants. Monitor for cross-organization operations or unexpected modifications to consumer data, entitlements, or activation keys.

Impact Analysis

If you are a low-privilege authenticated user, an attacker could exploit this to access or modify data they are not authorized to see or change. This includes reading consumer information, binding to entitlement pools, modifying activation keys, or revoking entitlements. The impact is higher in multi-tenant deployments where data from different organizations is managed.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Unauthorized disclosure of consumer information or modification of entitlements may result in non-compliance with data protection and privacy regulations.

Mitigation Strategies

Restrict Candlepin REST API access to trusted administrators only. Limit which principals can obtain consumer client certificates or manage activation keys. Apply vendor patches or updates as soon as they become available. Temporarily disable multi-@Verify endpoints if possible until a fix is deployed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart