vulnerability

Red Hat: CVE-2018-1000226: cobbler: XMLRPC API endpoints are not correctly validating security tokens

Name: Red Hat: CVE-2018-1000226: cobbler: XMLRPC API endpoints are not correctly validating security tokens
Creator: Red Hat
Published: 2018-08-20T00:00:00.000Z
Keywords: CVE, Red Hat, 2018, 1000226, cobbler, no-fix-redhat-rpm-package, Severity 8

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Aug 20, 2018

Added

Jul 9, 2025

Modified

Jul 9, 2025

Description

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

Solution

no-fix-redhat-rpm-package

References

NVD-CVE-2018-1000226

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report