Foreman Auth Bypass via host_verifier.rb in Satellite API
CVE-2026-12423 Published on October 1, 2026
Foreman: unauthenticated information disclosure via provisioning token validation flaw
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
Vulnerability Analysis
CVE-2026-12423 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 108 days later.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-12423
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
Red Hat Satellite 6.16 for RHEL 8:- Version 0:3.12.0.23-1.el8sat and below * is unaffected.
- Version 0:3.12.0.23-1.el9sat and below * is unaffected.
- Version 0:3.14.0.22-1.el9sat and below * is unaffected.
- Version 0:3.16.0.25-1.el9sat and below * is unaffected.
- Version 0:3.18.0.14-1.el9sat and below * is unaffected.