CVE-2026-12423

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

Score
CVSS 3.1 7.5 High
Status
Analyzed - secalert@redhat.com
Published
2026-10-01
Last modified
2026-10-08
Weaknesses
CWE-306

Affected products

References

 
 
© AVABIS GmbH privacypolicy about