CVE-2026-107151 in Satellite
Summary
by MITRE • 10/07/2026
Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the smart_proxy_dynflow package represents a critical authentication bypass within the remote execution task update mechanism, specifically affecting systems configured to operate in pull or pull-mqtt modes. This flaw allows an adversary who has already discovered the identifier of a running job to manipulate its outcome without possessing valid credentials for the target system. The core technical deficiency lies in the handling of progress and completion callbacks, which are designed to receive status reports from executing agents. In this implementation, these endpoints fail to verify the presence or validity of a one-time token before accepting input data. Consequently, any network actor with knowledge of the job identifier can inject fabricated output, effectively spoofing the execution result as either successful or failed. This lack of cryptographic verification means that the integrity of remote command and control operations is compromised, allowing for unauthorized manipulation of system state reporting without triggering authentication failures.
From an operational perspective, this vulnerability enables significant disruption to IT automation workflows and security monitoring systems. An attacker can falsely mark a critical maintenance task as successful when it has actually failed, leading administrators to believe that patches or configurations have been applied correctly while the underlying infrastructure remains vulnerable or misconfigured. Conversely, marking a benign operation as a failure could trigger unnecessary incident response procedures, causing operational fatigue and resource exhaustion. In environments relying on pull-based architectures where agents periodically check for tasks, this flaw allows an insider threat or a network attacker with local access to alter audit trails. This undermines the reliability of automated remediation processes and compromises the trustworthiness of centralized management consoles that depend on accurate task completion data for decision-making.
The technical nature of this defect aligns closely with CWE-287, which describes Improper Authentication, as the system fails to adequately verify identity before granting access to sensitive state-changing operations. Furthermore, it relates to CWE-345 Insufficient Verification of Data Authenticity because the application accepts data from an unverified source without validating its origin through a secure token mechanism. In terms of adversary tactics, this vulnerability facilitates techniques associated with MITRE ATT&CK T1078 Valid Accounts if used by insiders, or more broadly supports lateral movement and persistence strategies where false success reports are used to evade detection systems that rely on automated task completion logs for anomaly detection. The ability to spoof job outcomes effectively blinds security monitoring tools to actual system states, allowing malicious activities to proceed undetected under the guise of legitimate administrative actions.
Mitigation requires immediate implementation of strict authentication checks within the smart_proxy_dynflow callback handlers. Developers must ensure that every progress and completion request includes a valid, cryptographically signed one-time token or session identifier that is verified against an authorized list before any state changes are committed to the database. Additionally, implementing rate limiting on these endpoints can help mitigate brute-force attempts to discover job identifiers if such enumeration is possible. For organizations currently running affected versions, it is advisable to restrict network access to the smart proxy service to trusted management subnets only and to review recent task logs for anomalies in completion times or unexpected success markers that do not correlate with known operational windows. Upgrading to a patched version of the package where these authentication checks are enforced by default remains the most effective long-term solution.