CVE-2026-12423

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

• CWE-306

• https://access.redhat.com/errata/RHSA-2026:74503Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:74504Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:74505Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:74506Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-12423Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2488956Issue Tracking, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/10/07/10Third Party Advisory

Published

Oct 1, 2026

Last Modified

Oct 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12415The Invoice Generator plugin for WordPress is vulnerable to …9.8
• CVE-2026-12416The Invoice Generator plugin for WordPress is vulnerable to …9.8
• CVE-2026-12417The SignUp & SignIn plugin for WordPress is vulnerable to Au…9.8
• CVE-2026-12418The User Frontend: AI Powered Frontend Posting, User Directo…5.3
• CVE-2026-1242The BlockSpare plugin for WordPress is vulnerable to authori…4.3
• CVE-2026-12421The ARforms plugin for WordPress is vulnerable to Stored Cro…7.2
• CVE-2026-124249http.cookiejar.CookieJar deleted a stored cookie when a resp…6.3
• CVE-2026-12425Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-124258Missing Authorization vulnerability in ThemeGrill User Regis…5.3
• CVE-2026-12426The Members – Membership & User Role Editor Plugin plugin fo…5.3
• CVE-2026-124274Missing Authorization vulnerability in myCred myCred mycred …5.3
• CVE-2026-12428The Blocks for ACF Fields plugin for WordPress is vulnerable…6.5