CVE-2026-12423
Received Received - Intake

Authentication Bypass in Foreman via Provisioning Token Logic Flaw

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: redhat-SADP

Description
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-12423
EUVD
EUVD-2026-90915

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat foreman *
red_hat satellite From 6.19.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Red Hat Satellite's Foreman component. It allows an unauthenticated attacker to bypass authentication on the /unattended/provision API endpoint. The flaw occurs because the application checks if a provisioning token exists in the database rather than verifying it in the HTTP request. This lets attackers access sensitive provisioning data even without providing a valid token.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access attempts to the /unattended/provision API endpoint. Check logs for requests without tokens accessing sensitive provisioning data. Use tools like curl to test the endpoint: curl -v http://<satellite-server>/unattended/provision. If the server responds with provisioning templates without requiring a token, the system is vulnerable.

Impact Analysis

An attacker could extract sensitive data like the root user's SHA-512 password hash, internal IP network details, and active API build tokens. This could lead to unauthorized access, data breaches, or further compromise of systems managed by Red Hat Satellite.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized disclosure of personal or health data may result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Apply the official patch from Red Hat to require provisioning tokens for all operating system entries. Update affected Foreman packages immediately. Review and restrict access to the /unattended/provision endpoint. Consider disabling the endpoint if not in use. Monitor for unusual activity indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12423. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart