CVE-2026-107152High· 7.1▾ TwilightAn improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of serve…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
0.3% → 0.3%
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.
rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)rubygem-smart_proxy_dynflow (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107360Critical· 9.6Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions
CVE-2026-111456High· 7.1Candlepin: consumer certificate can register systems in another organization
CVE-2026-107443High· 7.7Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)
CVE-2026-86322High· 8.8Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller
CVE-2026-86324Medium· 4.3Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller
CVE-2026-86323Medium· 4.3Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller