{"id":"CVE-2026-107152","kind":"vulnerability","aliases":["CVE-2026-107152"],"related":[],"title":"smart_proxy_dynflow: task console accepts certs from untrusted servers","description":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.","summary":"The task console in the smart_proxy_dynflow package accepts any client certificate signed by the Capsule's certificate authority without checking the list of trusted servers. An attacker holding such a certificate can read job details, including passwords passed to jobs, and cancel running tasks.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"smart_proxy_dynflow","fixed":[],"affected":">= 0.4.0","ecosystem":"rubygems"}],"ecosystems":[],"tags":["authentication","capsule","foreman","package","ruby","satellite","smart-proxy"],"not_affected_if":["auth-required","no-ca-signed-certs-for-untrusted-hosts","no-capsule"],"how_to_check":"On each Capsule/Smart Proxy, check the installed rubygem-smart_proxy_dynflow version (rpm -q rubygem-smart_proxy_dynflow or gem list smart_proxy_dynflow); 0.4.0 or later carries the flaw per the Red Hat bug. Also check the dynflow settings file for console_auth: true (the default); console_auth: false removes the check entirely.","fix":"No fixed release yet. Red Hat says to apply the security update for Satellite/smart_proxy_dynflow when it is published (bug 2547374, deadline 2026-12-15).","status":"open","published_at":"2026-11-12T20:18:14+00:00","first_seen_at":"2026-11-12T20:40:22+00:00","triaged_at":"2026-11-12T20:42:13+00:00","updated_at":"2026-11-12T20:45:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T20:42:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"smart_proxy_dynflow: task console accepts certs from untrusted servers","impact":"medium","summary":"The task console in the smart_proxy_dynflow package accepts any client certificate signed by the Capsule's certificate authority without checking the list of trusted servers. An attacker holding such a certificate can read job details, including passwords passed to jobs, and cancel running tasks.","audience":"businesses","category":"package","nicknames":[],"who_cares":["satellite","capsule","foreman","smart-proxy","ruby"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads job passwords and cancels running tasks on the Capsule","analyst_note":"Confirm the affected smart_proxy_dynflow version ranges and whether a fixed release exists; check the NVD entry and the upstream Foreman or Satellite advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-capsule","auth-required"],"who_is_affected":"Teams running Red Hat Satellite or another Foreman-based deployment with a Capsule that runs the smart_proxy_dynflow task console. An attacker needs a client certificate signed by the Capsule's certificate authority, which is not a default public exposure. Systems without a Capsule using the dynflow task console are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4577,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected smart_proxy_dynflow version ranges and whether a fixed release exists; check the NVD entry and the upstream Foreman or Satellite advisory.","search":"'-107152':13A,16A '-2026':12A,15A 'accept':6A,38B,94C 'alreadi':125C 'also':151C 'attack':57B,121C 'authent':20B,77C 'author':48B,104C 'cancel':72B,152C 'capsul':21B,45B,101C,114C 'cert':7A 'certif':41B,47B,61B,97C,103C,129C 'check':50B,108C 'client':40B,96C 'consol':5A,31B,85C,93C,134C 'cve':11A,14A 'detail':65B,138C,140C 'dynflow':3A,19A,36B,90C 'foreman':22B 'found':81C 'given':147C 'hold':58B,126C 'improp':76C 'includ':66B,141C 'job':64B,70B,137C,145C 'list':52B,110C 'low':118C 'low-privileg':117C 'must':124C 'network':120C 'open':132C 'packag':23B,37B,91C 'pass':68B 'password':67B,142C 'privileg':119C 'proxi':2A,28B,35B,89C 'proxy':18A 'read':63B,136C 'rubi':24B 'run':73B,154C 'satellit':25B 'server':10A,55B,112C 'sign':42B,98C 'smart':1A,17A,27B,34B,88C 'smart-proxi':26B 'task':4A,30B,74B,84C,155C 'trust':54B,115C 'untrust':9A 'user':123C 'vulner':78C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Satellite 6 / Foreman Capsules and Smart Proxies running the smart_proxy_dynflow plugin (0.4.0 or later per the Red Hat bug) with the Dynflow console enabled (console_auth default). An attacker needs a client certificate signed by the Capsule's CA, for example a registered content host's certificate on Satellite, and network access to the proxy HTTPS port. They can read job inputs, including SSH and sudo passwords, and cancel tasks. Setups where no untrusted holder of a CA-signed certificate can reach the proxy can deprioritise.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:45:00Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-107152","run_id":3782},"who_affected":{"at":"2026-11-12T20:45:00Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-107152","run_id":3782}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["smartproxydynflow"],"ptokens":["dynflow","proxy","smart"],"labels":["authentication","capsule","foreman","high","package","ruby","satellite","smartproxy"],"campaign_type":null,"search_a":"'-107152':13A,16A '-2026':12A,15A 'accept':6A 'cert':7A 'consol':5A 'cve':11A,14A 'dynflow':3A,19A 'proxi':2A 'proxy':18A 'server':10A 'smart':1A,17A 'task':4A 'untrust':9A","search_b":"'accept':38B 'attack':57B 'authent':20B 'author':48B 'cancel':72B 'capsul':21B,45B 'certif':41B,47B,61B 'check':50B 'client':40B 'consol':31B 'detail':65B 'dynflow':36B 'foreman':22B 'hold':58B 'includ':66B 'job':64B,70B 'list':52B 'packag':23B,37B 'pass':68B 'password':67B 'proxi':28B,35B 'read':63B 'rubi':24B 'run':73B 'satellit':25B 'server':55B 'sign':42B 'smart':27B,34B 'smart-proxi':26B 'task':30B,74B 'trust':54B 'without':49B","search_c":"'accept':94C 'alreadi':125C 'also':151C 'attack':121C 'authent':77C 'author':104C 'cancel':152C 'capsul':101C,114C 'certif':97C,103C,129C 'check':108C 'client':96C 'consol':85C,93C,134C 'detail':138C,140C 'dynflow':90C 'found':81C 'given':147C 'hold':126C 'improp':76C 'includ':141C 'job':137C,145C 'list':110C 'low':118C 'low-privileg':117C 'must':124C 'network':120C 'open':132C 'packag':91C 'password':142C 'privileg':119C 'proxi':89C 'read':136C 'run':154C 'server':112C 'sign':98C 'smart':88C 'task':84C,155C 'trust':115C 'user':123C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107152","severity":null,"published_at":"2026-11-12T20:18:14+00:00","modified_at":"2026-11-12T20:18:14+00:00","first_seen_at":"2026-11-12T20:40:22+00:00","fetched_at":"2026-11-12T20:40:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107152:3782","url":"https://access.redhat.com/security/cve/CVE-2026-107152","severity":null,"published_at":"2026-11-12T20:45:00+00:00","modified_at":"2026-11-12T20:45:00+00:00","first_seen_at":"2026-11-12T20:45:00+00:00","fetched_at":"2026-11-12T20:45:00+00:00","note":"Read Red Hat CVE page and Bugzilla 2547374 (NVD only mirrors). No fix released as of 2026-11-12; Red Hat says no practical workaround. Exact upstream fixed version unknown; check Foreman/Satellite errata.","cites":["https://access.redhat.com/security/cve/CVE-2026-107152","https://bugzilla.redhat.com/show_bug.cgi?id=2547374"]}],"documents":[{"id":138448,"url":"https://access.redhat.com/security/cve/CVE-2026-107152","title":"Red Hat CVE-2026-107152","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":138449,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374","title":"Bug 2547374 Dynflow console authorizes any client certificate the capsule CA signed","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}