CVE-2026-12112
foreman
- Severity
- High
- Published
- June 23, 2026
- Last modified
- July 16, 2026
A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.
CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
- CWE-287 Improper authentication
References
- access.redhat.com
- access.redhat.comThird Party Advisory
- access.redhat.comThird Party Advisory
- bugzilla.redhat.comThird Party Advisory
- access.redhat.com
- access.redhat.comThird Party Advisory
- access.redhat.comThird Party Advisory
- bugzilla.redhat.comThird Party Advisory
Listed in
Related CVEs
The officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service…
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints.
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST…
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0.
The experimental tasks feature (taskStore) did not check which session created a task.