CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

Critical 9.8 Published 4 Sep 2024 Updated 11 Nov 2025

Attackers can bypass authentication via malformed headers in Pulpcore deployments using specific Gunicorn versions, gaining administrative access to Red Hat Satellite.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-7923?

CVE-2024-7923 is a critical authentication bypass vulnerability in Redhat Satellite, published on 4 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

Weakness: CWE-287

Which versions are affected by CVE-2024-7923?

It affects 1 product.

Products include Redhat Satellite.

How do I fix CVE-2024-7923?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-7923 being exploited?

There is no known exploitation of CVE-2024-7923 in the wild and no public exploit code.

All Redhat Satellite vulnerabilities

Sources

Also known as CLSA-2026-1772496720, CLSA-2026-1772496722, GHSA-pmjc-mxf4-8qwx.