CVE-2026-107152: fallo de gravedad alta en Red Hat Satellite 6.16 for RHEL 8
Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
18Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Productos afectados
Red Hat · Red Hat Satellite 6.16 for RHEL 8Red Hat · Red Hat Satellite 6.16 for RHEL 9Red Hat · Red Hat Satellite 6.17 for RHEL 9Red Hat · Red Hat Satellite 6.18 for RHEL 9CVEs relacionadas — Red Hat Satellite 6.16 for RHEL 8
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2026-12541HIGHForeman: command injection in foreman-rake database tasksEPSS 1.2%CVE-2026-12540HIGHForeman: command injection in foreman-rake errors:fetch_log via request_id parameterEPSS 1.2%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2026-0980HIGHRubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc usernameEPSS 0.9%