Threats tagged 'ghsa-g5rq-xf32-27w2'

CVE-2026-107152 is an improper authentication vulnerability in the task console of the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority without verifying the trusted server list. An attacker with a valid certificate can read sensitive job details, including passwords, and cancel running tasks. Red Hat rates this vulnerability as having a high confidentiality impact and low integrity impact. No practical workaround is currently available, and users are advised to apply security updates once released.