CVE-2026-107151: Missing Authentication for Critical Function in Red Hat Red Hat Satellite 6

This vulnerability arises from missing authentication checks in the progress and completion callbacks of remote-execution task updates within the smart_proxy_dynflow package of Red Hat Satellite 6. Specifically, these callbacks accept reports even when the one-time token is missing. An attacker or user who knows the identifier of a running job can send arbitrary job output, thereby marking the job as successful or failed. This issue applies when remote execution is configured in pull or pull-mqtt mode. The vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized modification of job results.

The vulnerability allows an unauthenticated network attacker or user who knows a running job's identifier to forge job output reports and alter the recorded status of that job to success or failure. This compromises the integrity of job execution results but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

The vendor advisory from Red Hat should be consulted for current remediation guidance. No explicit patch or fix information is provided in the input data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107151 for updates. Until a fix is applied, consider restricting network access to the remote execution service and monitoring for anomalous job status changes.