← Back

CVE-2026-12112

nvd nist
Published: Jun 23, 2026Modified: Jul 16, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.

Affected (2)

Redhat
1 product
Satellite
Theforeman
1 product
Foreman
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Satellite
Version 6.19
Foreman
All versions

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (9)

Source: secalert@redhat.com
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory

Timeline

No history available yet.