https://seclists.org/oss-sec/2026/q4/69: CVE-2026-12423: Foman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)

Q: Which deployments are exposed to this issue?

The exposed configuration is token-enabled provisioning on Red Hat-family systems where the IP/MAC fallback can be reached. Affected Foreman releases are 1.1 through 3.19.1 and 5.0.0.

Q: Does an attacker need credentials or a valid provisioning token?

No. An unauthenticated request can reach build-host provisioning through the IP/MAC fallback when no valid provisioning token is supplied.

Q: What data could be exposed?

The fallback can expose provisioning data. The listed CVSS vector rates confidentiality impact as high, with no integrity or availability impact.

Q: Which releases contain the fix?

The issue is fixed in Foreman 3.19.2 and 5.0.1.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Foreman>=1.1<=3.19.1, =5.0.0

Frequently Asked Questions

Which deployments are exposed to this issue?

The exposed configuration is token-enabled provisioning on Red Hat-family systems where the IP/MAC fallback can be reached. Affected Foreman releases are 1.1 through 3.19.1 and 5.0.0.

Does an attacker need credentials or a valid provisioning token?

No. An unauthenticated request can reach build-host provisioning through the IP/MAC fallback when no valid provisioning token is supplied.

What data could be exposed?

The fallback can expose provisioning data. The listed CVSS vector rates confidentiality impact as high, with no integrity or availability impact.

Which releases contain the fix?

The issue is fixed in Foreman 3.19.2 and 5.0.1.