Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-12423

Redhat Satellite: missing authentication can lead to authentication bypass

Risk score
56/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a h…
Affected
Redhat Satellite
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Redhat SatelliteTHE FLAWSTHE FIXCVE-2026-12423Missing authentication can leadto authentication bypassCVSS 7.5 · EPSS 0%CVE-2026-96658Code injection can lead toremote code executionCVSS 8.8 · EPSS 1%CVE-2026-12540OS command injection can leadto remote code executionCVSS 8.2 · EPSS 1%CVE-2026-12541OS command injectionCVSS 8.2 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedRedhat SatelliteAMBER · PATCH THIS WEEKRedhat SatelliteA flaw was found in Foreman.This vulnerability allows anauthenticated remote attackerwith low-level read permissionsto achieve arbitrary codeexecution on the underlyingserver. By manipulating the…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authentication (CWE-306)284 other warnings in 30 days →Same productEarlier Redhat Satellite warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Redhat Satellite: Amber, patch this week. A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation an…

The flaws

  • CVE-2026-12423: Missing authentication can lead to authentication bypass (CVSS 7.5 · EPSS 0%)
  • CVE-2026-96658: Code injection can lead to remote code execution (CVSS 8.8 · EPSS 1%)
  • CVE-2026-12540: OS command injection can lead to remote code execution (CVSS 8.2 · EPSS 1%)
  • CVE-2026-12541: OS command injection (CVSS 8.2 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Redhat Satellite

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

Last activity 1 Oct 2026. Patch Forecast updates every hour.