Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-12423: Foreman: provisioning token validation flaw An unauthenticated request can reach build-host provisioning through an IP/MAC fallback when no valid provisioning token is supplied. The fallback is reachable in token-enabled Red Hat-family provisioning configurations and can expose provisioning data.
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/69
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: Incomplete fix for Emacs CVE-2026-79992
Posted by Sam James on Oct 14 Sean Whitton writes: Red Hat, would you be willing to provide another CVE for this? Thank you.
Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat have found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries through Lightwell, their program for patching open…
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities
The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers
Multiple vulnerabilities in Jenkins
Posted by Kevin Guerroudj on Oct 28 Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their…
CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday so let's have it here too. Copied from the advisory on the edk2 repo: Summary While a…
AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently…