CVE-2026-12423

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description An authentication bypass exists in the '/unattended/provision' API endpoint due to a semantic logic flaw in host verifier.rb. The application checks the database state of a provisioning token instead of verifying its presence in the incoming HTTP request. Consequently, if a host is actively undergoing provisioning and has an unexpired token in the database, the valid host token?() method returns true, allowing access to the kickstart template even when no token is provided in the URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.