AI analysis
Foreman, including the Red Hat Satellite /unattended/provision API, has an authentication bypass caused by a logic flaw in host_verifier.rb (CWE-306). valid_host_token? treats a host as authorized when the database still holds an unexpired provisioning token, instead of checking that the HTTP request actually supplied that token. While a host is being provisioned, an unauthenticated remote attacker who sends no token can retrieve that host’s kickstart template (CVSS 7.5, high confidentiality impact only). Red Hat Satellite and Foreman installations are affected; no affected version range was given in the advisory data. There is no known public proof of concept and the issue is not listed in CISA KEV.
What to do: Apply the Red Hat and Foreman security updates for CVE-2026-12423 as soon as they are available for your release; the advisory data does not name a fixed version. Until then, do not expose /unattended/provision to untrusted networks, restrict it to provisioning hosts and build networks, and review access logs for unauthenticated retrieval of kickstart templates while a host token is unexpired.
Affected
| Red Hat Satellite | — |
| Foreman | — |
Estimated exposure
moderateOn the order of 1,000–10,000 Satellite/Foreman deployments, only while a host is actively provisioning — Satellite and Foreman are on-premises enterprise Linux lifecycle tools, not a mass-market product, so plausible deployments are in the thousands rather than hundreds of thousands; no install census or internet-scan count was in the data,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.