CVE-2026-12423: Foreman: unauthenticated information disclosure via provisioning token validation flaw
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's validhosttoken? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
Other sources
Description
The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.
Because a host actively undergoing provisioning has an unexpired token in the database, the server's validhosttoken? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
--------------------------------------------------------------------------------
/usr/share/foreman/app/services/foreman/unattendedinstallation/hostverifier.rb
def validhosttoken?
return true unless @needstoken
return true unless forhosttemplate
VULNERABILITY: This only checks if the token in the database is currently expired.
It does NOT verify if the requester actually provided a valid token in the URL.
return true unless @host&.tokenexpired?
errors << { ... }
false
end
--------------------------------------------------------------------------------
Impact
By utilizing the enumeration technique detailed in F-26 Infrastructure Mapping via Observable Response Discrepancy, an unauthenticated remote attacker can actively poll the endpoint for a host entering a build state and extract its complete provisioning template. These templates contain highly sensitive data, including the root user's SHA-512 password hash, internal IP topography, and active API build tokens.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to unauthenticated requests?
The affected endpoint can expose a kickstart template when a host is actively undergoing provisioning and has an unexpired provisioning token recorded in the database.
What must an attacker provide to retrieve the template?
An attacker can make a request to the /unattended/provision API endpoint without providing a provisioning token in the URL. No authentication, privileges, or user interaction are required.
What is disclosed if exploitation succeeds?
The requester is granted access to the kickstart template associated with the provisioning host.
Are vendor fixes available?
Red Hat has published errata RHSA-2026:74503, RHSA-2026:74504, and RHSA-2026:74506 for this issue.