CVE-2026-107152: Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed
An improper authentication vulnerability has been found in the task console in the smartproxydynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have network access to the task console and already possess a client certificate signed by the capsule's certificate authority. The certificate does not need to belong to a server the capsule explicitly trusts.
What can an attacker do after accessing the console?
They can read job details, which may expose passwords supplied to jobs, and they can cancel a running task.
Are systems affected by default?
The provided information does not state whether the vulnerable console configuration is enabled or exposed by default.