Red Hat Satellite: Authentication bypass in provisioning endpoint
Summary
The /unattended/provision endpoint of Red Hat Satellite (upstream Foreman) does not properly verify the provisioning token in the HTTP request. It only checks whether a host is currently being provisioned, so a request without any token can retrieve the kickstart provisioning template. Reported impact includes root password hashes, internal network details and build tokens, which can enable follow-on attacks. The attack requires only network access to the Satellite instance and a host in the provisioning phase.
Affected
- Red Hat Satellite 6.16 (RHEL 8 and 9), Foreman package 3.12.0.23-1 and earlier
- Red Hat Satellite 6.17 (RHEL 9), Foreman package 3.14.0.22-1 and earlier
- Red Hat Satellite 6.18 (RHEL 9), Foreman package 3.16.0.25-1 and earlier
- Red Hat Satellite 6.19 (RHEL 9), Foreman package 3.18.0.14-1 and earlier
- Older Satellite releases: Unknown.
Fixed in
- Satellite 6.19.5 (RHSA-2026:74503)
- Satellite 6.18.10 (RHSA-2026:74504)
- Satellite 6.17.12 (RHSA-2026:74505)
- Satellite 6.16.14 (RHSA-2026:74506)
Workaround
Red Hat has not identified a practical workaround. Restricting network access to the provisioning endpoint to trusted build networks reduces the exposure but is not a vendor-confirmed fix.
Exploitation
- CISA SSVC data from Red Hat: exploitation none, automatable yes.
- No public proof of concept found in our research. This does not prove that none exists.
- Not listed in the CISA KEV catalog.
Our recommendation
- Identify all Satellite and Capsule instances and their versions.
- Update to the fixed release for your stream and test iPXE and bootdisk provisioning beforehand.
- Restrict access to the provisioning endpoint to build networks and do not expose Satellite to the internet.
- If an instance was reachable from untrusted networks, review logs for unattended requests and rotate root passwords and provisioning tokens.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Security Advisory RHSA-2026:74503 (Satellite 6.19.5) access.redhat.com
- Red Hat Security Advisory RHSA-2026:74504 (Satellite 6.18.10) access.redhat.com
- Red Hat Security Advisory RHSA-2026:74505 (Satellite 6.17.12) access.redhat.com
- Red Hat Security Advisory RHSA-2026:74506 (Satellite 6.16.14) access.redhat.com
- Red Hat CVE record CVE-2026-12423 access.redhat.com
- Red Hat Bugzilla 2488956 bugzilla.redhat.com
- Foreman community: side effects of the token validation fix community.theforeman.org
- oss-security mailing list post www.openwall.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 23:46.
Original description (NVD)
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
NVD references (7)
- https://access.redhat.com/errata/RHSA-2026:74503
- https://access.redhat.com/errata/RHSA-2026:74504
- https://access.redhat.com/errata/RHSA-2026:74505
- https://access.redhat.com/errata/RHSA-2026:74506
- https://access.redhat.com/security/cve/CVE-2026-12423
- https://bugzilla.redhat.com/show_bug.cgi?id=2488956
- http://www.openwall.com/lists/oss-security/2026/10/07/10
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.