Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed
Summary
| CVE | CVE-2026-107152 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-12 20:18:14 UTC |
| Updated | 2026-11-13 00:20:06 UTC |
| Description | An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Problem Types: CWE-287 | CWE-287 Improper Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| 3.1 | CNA | CVSS | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Satellite 6.16 For RHEL 8 | unaffected 0:0.9.3-2.el8sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.16 For RHEL 8 | unaffected 0:0.9.3-2.el8sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.16 For RHEL 9 | unaffected 0:0.9.3-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.16 For RHEL 9 | unaffected 0:0.9.3-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:0.9.4-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:0.9.4-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.18 For RHEL 9 | unaffected 0:0.9.4-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.18 For RHEL 9 | unaffected 0:0.9.4-2.el9sat * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:99952 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:99949 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:99950 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-107152 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-07T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-11-12T18:46:00.000Z | Made public. |
Workarounds
CNA: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.
There are currently no legacy QID mappings associated with this CVE.