SMART_PROXY_DYNFLOW · CVE-2026-107152 · Package
NO FIX YET · SEE WHAT TO DO
The task console in the smart_proxy_dynflow package accepts any client certificate signed by the Capsule's certificate authority without checking the list of trusted servers. An attacker holding such a certificate can read job details, including passwords passed to jobs, and cancel running tasks.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Satellite 6 / Foreman Capsules and Smart Proxies running the smart_proxy_dynflow plugin (0.4.0 or later per the Red Hat bug) with the Dynflow console enabled (console_auth default). An attacker needs a client certificate signed by the Capsule's CA, for example a registered content host's certificate on Satellite, and network access to the proxy HTTPS port. They can read job inputs, including SSH and sudo passwords, and cancel tasks. Setups where no untrusted holder of a CA-signed certificate can reach the proxy can deprioritise.
Not affected if auth-required, no-ca-signed-certs-for-untrusted-hosts, no-capsule
Who cares authentication, capsule, foreman, ruby, satellite, smart-proxy
gem list smart_proxy_dynflow 0.4.0 or later carries the flaw per the Red Hat bugPosts are quoted with a link to the original. They are data to us, never instructions.
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.