CVE-2026-106471: Candlepin authorization bypass in verification filter

CVE-2026-106471 · Severity: high · CVSS 8.1 · Published 2026-10-07

Candlepin is a subscription and entitlement management service used by Red Hat to manage software licenses and subscriptions. An authenticated attacker can bypass authorization checks to view and modify consumer information, entitlements, and subscriptions they should not have access to, potentially affecting multiple organizations. The attack requires knowledge of specific resource identifiers but does not require elevated privileges or user interaction.

Vendors: Red Hat.

Quick answers

Is CVE-2026-106471 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106471 being exploited in the wild.
How severe is CVE-2026-106471?
High severity, with a CVSS score of 8.1, published 7 October 2026.
Which products and versions are affected?
Red Hat Candlepin.
Is there a fix for CVE-2026-106471?
No fixed version is recorded yet. Restrict Candlepin REST API access to trusted administrators until a patched build is deployed. Limit which principals can obtain consumer client certificates or manage activation keys. Exploitation requires knowledge of target resource identifiers (consumer UUIDs, entitlement IDs, pool IDs, certificate serials) which are not normally visible across organizations.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-106471 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106471?
Check whether you run Red Hat Candlepin. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict Candlepin REST API access to trusted administrators until a patched build is deployed. Limit which principals can obtain consumer client certificates or manage activation keys. Exploitation requires knowledge of target resource identifiers (consumer UUIDs, entitlement IDs, pool IDs, certificate serials) which are not normally visible across organizations.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07"}]

Technical details

The central authorization filter in Candlepin's VerifyAuthorizationFilter incorrectly implements multi-parameter authorization checks marked with @Verify annotations, granting access if any one parameter is accessible rather than requiring all to be accessible. A low-privilege authenticated attacker can exploit this to bypass authorization, reading and modifying consumer information, entitlements, and subscription resources across organizations when target resource identifiers (UUIDs, IDs, serials) are known. The fix is available in patched Candlepin builds.

Affected products

  • Red Hat Candlepin

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.