CVE

CVE-2018-1000226

9.8

CVSS

Description

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

Attack Vector

Privileges Req.

User Interaction

Updated Oct 23, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2018-1000226 Scanner

CVE-2018-1000226 scanner - Improper Access Control vulnerability in Cobbler

Used 3.3k times · 3.4k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →