Is CVE-2026-111456 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111456 being exploited in the wild.

How severe is CVE-2026-111456?

High severity, with a CVSS score of 7.1, published 12 November 2026.

Which products and versions are affected?

Red Hat Candlepin 0.4.7 and later.

Is there a fix for CVE-2026-111456?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111456 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111456?

Check whether you run Red Hat Candlepin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111456: Candlepin authorization bypass in consumer registration

CVE-2026-111456 · Severity: high · CVSS 7.1 · Published 2026-11-12

Candlepin is a subscription management system used by Red Hat Satellite to manage software entitlements and subscriptions. An attacker with a valid consumer certificate from one organization can bypass authorization checks to register new consumers in a different organization, gaining access to that organization's subscription pools and potentially its entitlements. This allows unauthorized access to subscription benefits and subscription data across organizational boundaries.

Vendors: Red Hat.

Quick answers

Is CVE-2026-111456 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111456 being exploited in the wild.
How severe is CVE-2026-111456?: High severity, with a CVSS score of 7.1, published 12 November 2026.
Which products and versions are affected?: Red Hat Candlepin 0.4.7 and later.
Is there a fix for CVE-2026-111456?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111456 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111456?: Check whether you run Red Hat Candlepin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ConsumerResource.setupOwner() function in Candlepin's consumer registration module performs authorization checks only for user-authenticated callers, not for certificate-authenticated consumers. An attacker with a valid consumer identity certificate can supply an arbitrary organization key to register a new consumer in a different organization, bypassing the permission check. The attacker then receives an identity certificate for the new consumer, allowing access to the target organization's subscription pools and entitlements.

Affected products

Red Hat Candlepin 0.4.7 and later

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.