CVE-2026-107151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107151", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-07T10:19:09.047Z", "datePublished": "2026-10-07T12:36:29.932Z", "dateUpdated": "2026-10-10T02:21:07.819Z"}, "containers": {"cna": {"title": "Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Satellite 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rubygem-smart_proxy_dynflow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:satellite:6"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-107151", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547357", "name": "RHBZ#2547357", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-07T12:15:22.484Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-306: Missing Authentication for Critical Function", "workarounds": [{"lang": "en", "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."}], "timeline": [{"lang": "en", "time": "2026-10-07T10:11:19.686Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-07T12:15:22.484Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-07T12:36:29.932Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-10T02:20:55.845255Z", "id": "CVE-2026-107151", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-10T02:21:07.819Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107151", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-10T02:20:55.845255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-10T02:21:02.496Z"}}], "cna": {"title": "Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests", "credits": [{"lang": "en", "value": "Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "rubygem-smart_proxy_dynflow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-10-07T10:11:19.686Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-07T12:15:22.484Z", "value": "Made public."}], "datePublic": "2026-10-07T12:15:22.484Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-107151", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547357", "name": "RHBZ#2547357", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-07T12:36:29.932Z"}, "x_redhatCweChain": "CWE-306: Missing Authentication for Critical Function"}}, "cveMetadata": {"cveId": "CVE-2026-107151", "state": "PUBLISHED", "dateUpdated": "2026-10-10T02:21:07.819Z", "dateReserved": "2026-10-07T10:19:09.047Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-07T12:36:29.932Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "affected", "packageName": "rubygem-smart_proxy_dynflow", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result."}], "id": "CVE-2026-107151", "lastModified": "2026-10-10T03:17:05.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107151", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-10T02:20:55.845255Z", "version": "2.0.3"}}]}, "published": "2026-10-07T13:17:19.783", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-107151"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547357"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue.", "bugzilla": {"description": "rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests", "id": "2547357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547357"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-306", "details": ["Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result."], "mitigation": {"lang": "en:us", "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."}, "name": "CVE-2026-107151", "package_state": [{"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "rubygem-smart_proxy_dynflow", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-07T12:15:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107151\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107151"], "statement": "Red Hat Product Security has rated this vulnerability with a Moderate security impact.\nThis vulnerability affects smart_proxy_dynflow's remote-execution task callback handling.\nAttack complexity is high (AC:H). The caller must already know the identifier of a running job. That identifier cannot be guessed, and this flaw does not reveal it. Privileges required are none (PR:N). The caller needs no account and no client certificate. The default mode is ssh, and in that mode the submitted result is discarded.\nThis flaw lets the caller write a job result. It does not let the caller read job data. The recorded job output, the recorded exit status, and the host's execution status in Satellite can be set by the caller, including to success.\n```\nThe vulnerable callback check was introduced in smart_proxy_dynflow version 0.4.0. All versions from 0.4.0 through 1.0.0 are affected.\n```", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Satellite 6", "source": "cna", "vendor": "Red Hat"}, "product": "red_hat_satellite_6", "vendor": "red_hat"}], "created": "2026-10-07T15:00:07.019510+00:00", "updated": "2026-10-07T16:30:17.062254+00:00", "vendors": ["red_hat", "red_hat$PRODUCT$red_hat_satellite_6"]}