Skip to content
Fencer Vulns
critical 9.8

CVE-2018-1000226 in the critical feed json

Cobbler Improper Validation of Security Tokens

published 2018-08-20 8 y ago modified 2026-10-27 12 d ago also GHSA-f88q-22g8-frcg , PYSEC-2026-315 , EUVD-2022-3725

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
12.6%
EPSS 12.6% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known, plus a Nuclei check

Summary

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

Patch / fix

  • pypi cobbler 3.0.0
  • cobbler Ubuntu Pro 16.04 LTS 2.4.1-0ubuntu2+esm1

ubuntu advisories UBUNTU-CVE-2018-1000226

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • release-notes-susemanager Manager Server 3.1 3.1.8-5.38.1
  • release-notes-susemanager-proxy Manager Proxy 3.1 3.1.8-0.15.29.1
  • cobbler Manager Server 3.1 2.6.6-5.17.1
  • cobbler OpenStack Cloud 8, Manager Server 3.0, Manager Client Tools 12 +1 more 2.6.6-49.14.1
  • cobbler Manager Server 3.2 2.6.6-6.7.1

suse advisories SUSE-RU-2018:2639-1SUSE-SU-2018:2608-1SUSE-SU-2018:2561-1SUSE-SU-2018:2551-1

  • cobbler openSUSE Tumbleweed 3.2.1.336+git.5639a3af-1.1
  • cobbler Package Hub 15 SP2 3.1.2-bp152.4.3.1
  • cobbler openSUSE Leap 15.2 3.1.2-lp152.6.3.1

opensuse advisories openSUSE-SU-2024:10690-1openSUSE-SU-2021:0058-1openSUSE-SU-2021:0046-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000226 updated cvss 7.3

cobbler: XMLRPC API endpoints are not correctly validating security tokens

  • Red Hat Enterprise Linux 8 koan, python3-koan Red Hat Satellite 5 cobbler
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

12.58% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi cobbler
<3.0.0
3.0.0

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.