{"id":"CVE-2026-12112","aliases":["EUVD-2026-38599","GHSA-6v32-2jc8-w595"],"status":"published","title":"Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse","description":"A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00216,"percentile":0.12141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-06-23T19:40:51Z","modified":"2026-10-25T23:10:00Z","products":[{"vendor":"red hat","product":"red hat satellite 6.18"},{"vendor":"red hat","product":"red hat satellite 6.19"},{"vendor":"redhat","product":"satellite"},{"vendor":"theforeman","product":"foreman"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:28405","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28438","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12112","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488031","tags":["issue-tracking","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12112.json","tags":["x_sadp-csaf-vex","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12112"},{"url":"https://github.com/advisories/GHSA-6v32-2jc8-w595"}],"sources":{"cve":[{"id":"CVE-2026-12112","title":"Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse","description":"A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.","status":"published","published":"2026-06-23T19:40:51.36Z","modified":"2026-07-16T12:04:38.063Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287","CWE-287"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-38599","description":"A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.","status":"published","published":"2026-06-23T19:40:51Z","modified":"2026-07-16T12:04:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:52.35951Z"}],"ghsa":[{"id":"GHSA-6v32-2jc8-w595","title":"A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server...","description":"A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.","status":"published","published":"2026-06-23T21:30:31Z","modified":"2026-07-15T15:33:48Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:33.182129Z"}],"nvd":[{"id":"CVE-2026-12112","description":"A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.","status":"published","published":"2026-06-23T21:16:54.823Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:25.288279Z"}]}}