CVE-2026-12423 describes an authentication bypass vulnerability in Red Hat Satellite's /unattended/provision API endpoint. The flaw is due to a semantic logic error in host_verifier.rb where the valid_host_token? method checks for an unexpired provisioning token in the database rather than verifying the token's presence in the incoming HTTP request. This allows an attacker to gain access to the kickstart template during provisioning without supplying a valid token. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Red Hat has issued an official security advisory with a patch available in Red Hat Satellite 6.19.5 for RHEL 9.

An attacker can bypass authentication on the /unattended/provision API endpoint, gaining unauthorized access to the kickstart template used during system provisioning. This could lead to unauthorized provisioning actions or information disclosure related to provisioning templates. The vulnerability does not impact integrity or availability but has a high confidentiality impact.

Red Hat has released an official security update fixing this vulnerability in Red Hat Satellite 6.19.5 for RHEL 9. Users should apply this update as soon as possible. Prior to applying this update, ensure all previously released errata relevant to your system have been applied. Refer to the Red Hat advisory at https://access.redhat.com/errata/RHSA-2026:74503 for detailed patching instructions. No additional mitigations are indicated by the vendor advisory.