Answer in brief
CVE-2026-107152 records a High severity (CVSS 7.1) vulnerability in Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed. The current sources do not mark it as known exploited. The current feed maps Red Hat/rubygem-smart_proxy_dynflow (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/rubygem-smart_proxy_dynflow (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/rubygem-smart_proxy_dynflowgeneric | * | Not reported |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.
Quoted source text, attributed separately from HOL analysis.