Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106471— Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

Quick assessment

Affected
Red Hat Red Hat Satellite 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Candlepin 中发现了一个漏洞。中央授权过滤器在多个带有 @Verify 注解的参数中，只要其中任意一个可访问就错误地授予了访问权限，而不是要求所有经过验证的实体都必须可访问。具备较低权限的已认证攻击者，如果能够访问第一个引用的对象，就可以绕过对后续对象的授权检查。当目标资源标识符已知时，这可能导致未经授权地披露消费者信息，以及未经授权地修改权益和相关订阅资源，包括跨组织的情况。

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106471

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Satellite 6 - cpe:/a:redhat:satellite:6

II. Public POCs for CVE-2026-106471

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106471

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-106471 (2)

Same Patch Batch · Red Hat · 2026-10-07 · 6 CVEs total

CVE-2026-107121 6.5 MEDIUM Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downg
CVE-2026-103869 6.5 MEDIUM Pulp-ansible: bearer tokens are reused across remotes in a worker
CVE-2026-103868 6.5 MEDIUM Pulp-container: registry credentials are reused across remotes in a worker
CVE-2026-106061 5.5 MEDIUM Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file
CVE-2026-103870 5.0 MEDIUM Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

IV. Related Vulnerabilities

Same product: Red Hat Satellite 6
Same vendor: Red Hat
Same weakness: CWE-863

V. Comments for CVE-2026-106471

No comments yet

Leave a comment