{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-107151","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-10-07T10:19:09.047Z","datePublished":"2026-10-07T12:36:29.932Z","dateUpdated":"2026-10-07T12:36:29.932Z"},"containers":{"cna":{"title":"Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests","metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Satellite 6","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-smart_proxy_dynflow","defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-107151","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547357","name":"RHBZ#2547357","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-10-07T12:15:22.484Z","problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-306: Missing Authentication for Critical Function","workarounds":[{"lang":"en","value":"Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."}],"timeline":[{"lang":"en","time":"2026-10-07T10:11:19.686Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-07T12:15:22.484Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-07T12:36:29.932Z"},"x_generator":{"engine":"cvelib 1.8.0"}}}}