https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T02:03:04.508566+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-111846 EUVD-2026-111846 2026-10-17T02:03:04.519914+00:00 EUVD-2026-111846 https://cve.radiocsirt.org/vuln/fkie_cve-2012-3503 fkie_cve-2012-3503 2026-10-17T02:03:04.519992+00:00

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

 https://cve.radiocsirt.org/vuln/ghsa-5xv2-q475-rwrh GHSA-5xv2-q475-rwrh — Katello uses hard coded credential 2026-10-17T02:03:04.520042+00:00

Affected: RubyGems: katello

The installation script in Katello 1.0 and earlier does not properly generate the `Application.config.secret_token` value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default `secret_token`.

 https://cve.radiocsirt.org/vuln/gsd-2012-3503 gsd-2012-3503 2026-10-17T02:03:04.520080+00:00 gsd-2012-3503 https://cve.radiocsirt.org/vuln/rhsa-2012:1186 RHSA-2012:1186 — Red Hat Security Advisory: katello security update 2026-10-17T02:03:04.520093+00:00

Katello: Application.config.secret_token is not generated properly