---
id: CVE-2026-107152
title: >-
  Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate
  the capsule ca signed
summary: >-
  An improper authentication vulnerability has been found in the task console in
  the smart_proxy_dynflow package. The console accepts any client certificate
  signed by the capsule's certificate authority. It does not check the list of
  serve…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: Red Hat
product: rubygem-smart_proxy_dynflow
affected:
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
  - rubygem-smart_proxy_dynflow (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-13T15:38:13.405900Z'
published: '2026-11-12'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T16:58:21.597Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107152'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:100120'
    label: 'RHSA-2026:100120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99949'
    label: 'RHSA-2026:99949'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99950'
    label: 'RHSA-2026:99950'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99952'
    label: 'RHSA-2026:99952'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-107152'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547374'
    label: RHBZ#2547374
tags:
  - cve.org
epss: 0.00274
epssPercentile: 0.20065
ingestedAt: '2026-11-12T20:54:37.331Z'
---

## Overview

An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.

## Affected

- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`
- `rubygem-smart_proxy_dynflow (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.