{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/smart_proxy_dynflow/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:the_foreman:smart_proxy_dynflow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-107152"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["smart_proxy_dynflow"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","the-foreman"],"_cs_type":"advisory","_cs_vendors":["The Foreman"],"content_html":"\u003cp\u003eThe smart_proxy_dynflow package contains an improper authentication vulnerability (CVE-2026-107152) within its task console. The component fails to correctly validate client certificates against the list of servers trusted by the capsule. An attacker possessing a client certificate signed by the capsule's certificate authority can bypass authentication to access job details, including sensitive passwords, or perform unauthorized actions such as cancelling running tasks. The vulnerability has been assigned a CVSS v3.1 base score of 7.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to job information, including potential credential exposure, and enables malicious actors to disrupt operational workflows by cancelling active jobs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eReview the configuration of the smart_proxy_dynflow task console to ensure strict certificate validation. Monitor infrastructure for unauthorized access to the console endpoint. Organizations should consult The Foreman security advisories for the specific patched version addressing CVE-2026-107152 and apply it immediately.\u003c/p\u003e\n","date_modified":"2026-11-12T20:48:22Z","date_published":"2026-11-12T20:48:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-smart-proxy-dynflow-auth-cve-2026-107152/","summary":"The Foreman smart_proxy_dynflow package fails to properly validate client certificates, allowing attackers with a valid CA-signed certificate to access sensitive job details or manipulate running tasks.","title":"The Foreman smart_proxy_dynflow: Improper authentication in task console (CVE-2026-107152)","url":"https://feed.craftedsignal.io/briefs/2026-11-smart-proxy-dynflow-auth-cve-2026-107152/"}],"language":"en","title":"CraftedSignal Threat Feed - Smart_proxy_dynflow","version":"https://jsonfeed.org/version/1.1"}