The Foreman smart_proxy_dynflow: Improper authentication in task console (CVE-2026-107152)

The smart_proxy_dynflow package contains an improper authentication vulnerability (CVE-2026-107152) within its task console. The component fails to correctly validate client certificates against the list of servers trusted by the capsule. An attacker possessing a client certificate signed by the capsule's certificate authority can bypass authentication to access job details, including sensitive passwords, or perform unauthorized actions such as cancelling running tasks. The vulnerability has been assigned a CVSS v3.1 base score of 7.1.

Impact

Successful exploitation allows unauthorized access to job information, including potential credential exposure, and enables malicious actors to disrupt operational workflows by cancelling active jobs.

Recommendation

Review the configuration of the smart_proxy_dynflow task console to ensure strict certificate validation. Monitor infrastructure for unauthorized access to the console endpoint. Organizations should consult The Foreman security advisories for the specific patched version addressing CVE-2026-107152 and apply it immediately.