CVE-2026-12423— Foreman: unauthenticated information disclosure via provisioning token validation flaw
Quick assessment
Affected
Red Hat Red Hat Satellite 6.19 for RHEL 9
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Foreman 中发现了一个漏洞。Red Hat Satellite 的 API 端点由于 中存在语义逻辑缺陷，存在身份验证绕过风险。该应用程序验证的是数据库中预配令牌的状态，而非其在传入的 HTTP 请求中是否实际存在。由于正在主动进行预配的主机在数据库中拥有一个未过期的令牌，服务器的 方法会返回 true，从而允许访问 kickstart 模板，即使请求方在 URL 中根本没有提供任何令牌。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12423
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Foreman: unauthenticated information disclosure via provisioning token validation flaw
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.18.0.14-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.19::el9
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
II. Public POCs for CVE-2026-12423
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12423
请登录查看更多情报信息。
Other References for CVE-2026-12423 (3)
Same Patch Batch · Red Hat · 2026-10-01 · 16 CVEs total
| CVE-2026-96658 | 9.9 CRITICAL | Foreman: safemode bypass leading to rce |
| CVE-2026-96659 | 9.1 CRITICAL | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-12405 | 8.8 HIGH | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user |
| CVE-2026-12541 | 8.2 HIGH | Foreman: command injection in foreman-rake database tasks |
| CVE-2026-12540 | 8.2 HIGH | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter |
| CVE-2026-12544 | 7.7 HIGH | Foreman: ssti and insecure deserialization in foreman-rake configuration |
| CVE-2026-96577 | 7.1 HIGH | Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without a |
| CVE-2026-12545 | 6.7 MEDIUM | Rubygem-hammer_cli: command injection via insecure editor invocation |
| CVE-2026-103884 | 6.5 MEDIUM | Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allow |
| CVE-2026-56097 | 6.5 MEDIUM | Rubygem-katello: sql injection in registry proxy via labels |
| CVE-2026-83589 | 6.1 MEDIUM | Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect |
| CVE-2026-103754 | 5.9 MEDIUM | Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows |
| CVE-2026-103641 | 5.5 MEDIUM | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder |
| CVE-2026-12542 | 5.3 MEDIUM | Foreman: command injection in foreman-tail |
| CVE-2026-56098 | 4.3 MEDIUM | Rubygem-katello: improper authorization logic allows resource enumeration |
IV. Related Vulnerabilities
Same product: Red Hat Satellite 6.19 for RHEL 9
-
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-56097
Rubygem-katello: sql injection in registry proxy via labels -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in -
CVE-2026-12542
Foreman: command injection in foreman-tail -
CVE-2026-96658
Foreman: safemode bypass leading to rce
Same vendor: Red Hat
-
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in -
CVE-2026-12542
Foreman: command injection in foreman-tail -
CVE-2026-56097
Rubygem-katello: sql injection in registry proxy via labels
Same weakness: CWE-306
-
CVE-2026-104181
Filament: Multi-factor authentication (app) management actio -
CVE-2026-14983
Missing Authentication in Teledyne FLIR Robots running Aware -
CVE-2026-104058
Podgrab Missing Authentication on WebSocket /ws Endpoint -
CVE-2026-78578
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Re -
CVE-2026-78577
Unauthenticated Onboarding Scan Information Disclosure in TP
V. Comments for CVE-2026-12423
No comments yet