Vulnerability · Published Oct 7, 2026 · Assigned by redhat

CVE-2026-107151Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

Medium 5.9

In plain English

A medium-severity missing authentication in Red Hat Satellite 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 68.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Satellite 6	see references

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://access.redhat.com/security/cve/CVE-2026-107151 vdb-entry, x_refsource_REDHAT
RHBZ#2547357 issue-tracking, x_refsource_REDHAT