EUVD-2026-90915
GHSA-6m3j-qcjr-3vqm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network endpoint reachable without authentication or interaction (AV:N/PR:N/UI:N); disclosure of kickstart templates is confidentiality-only (C:H, I:N, A:N); AC:L since the token-present window is common during provisioning.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
AnalysisAI
Unauthenticated remote attackers can pull the kickstart provisioning template from Red Hat Satellite 6's /unattended/provision endpoint without supplying any token, provided a host is currently mid-provisioning and therefore has an unexpired token recorded in the Satellite database. The flaw is a semantic logic error in Foreman's host_verifier.rb: valid_host_token? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a target host to be actively undergoing provisioning so that an unexpired provisioning token exists in the Satellite database; the valid_host_token? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, moderately high priority for environments running affected Red Hat Satellite versions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in Red Hat errata RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), which is the vendor's remediation for Red Hat Satellite 6 including Satellite 6.19 for RHEL 9; patch available per vendor advisory, with the exact fixed build not enumerated in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to the /unattended/provision endpoint on all Red Hat Satellite 6 servers to only trusted provisioning networks using firewall rules or a reverse proxy, and enable logging to detect unauthorized template retrieval attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today