CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)

Foreman, including the Red Hat Satellite /unattended/provision API, has an authentication bypass caused by a logic flaw in host_verifier.rb (CWE-306). valid_host_token? treats a host as authorized when the database still holds an unexpired provisioning token, instead of checking that the HTTP request actually supplied that token. While a host is being provisioned, an unauthenticated remote attacker who sends no token can retrieve that host’s kickstart template (CVSS 7.5, high confidentiality impact only). Red Hat Satellite and Foreman installations are affected; no affected version range was given in the advisory data. There is no known public proof of concept and the issue is not listed in CISA KEV.

Apply the Red Hat and Foreman security updates for CVE-2026-12423 as soon as they are available for your release; the advisory data does not name a fixed version. Until then, do not expose /unattended/provision to untrusted networks, restrict it to provisioning hosts and build networks, and review access logs for unauthenticated retrieval of kickstart templates while a host token is unexpired.