CVE-2026-107151

MediumCVSS 5.9/10Last modified Oct 10, 2026

Description

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Satellite 6	—

References

Timeline

Published: Oct 7, 2026
Last modified: Oct 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071527.1An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any clie CVE-2026-1071537.0Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physi CVE-2026-1071548.8A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially e CVE-2026-1071558.8A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could p CVE-2026-1071572.0Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application an CVE-2026-1071585.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that CVE-2026-1071596.5MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local CVE-2026-107167.5Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGI CVE-2026-1071605.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain CVE-2026-1071617.5A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the CVE-2026-1071626.8Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate CVE-2026-1071665.3A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/up