CVE-2026-12423: Foreman: unauthenticated information disclosure via provisioning token validation flaw

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-08
Weakness: CWE-306

Description

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

Affected products

Red Hat Satellite 6: from 6.16 before 6.16.4; from 6.17 before 6.17.12; from 6.19 before 6.19.5; from 6.18 before 6.18.10; 6.0 — fixed in 6.16.4, 6.17.12, 6.18.10, 6.19.5
foreman: all versions

How to fix

Upgrade to a fixed version: Red Hat Satellite 6 6.16.4, 6.17.12, 6.18.10, 6.19.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-12423 or the next vulnerability affects your stack