CVE-2026-12423 | BDVDB-2026-381685 Detail

Description#

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-01Record published in the CVE List.
2. Version 22026-11-02Most recent update recorded in the CVE List.