CVE-2026-47688: FOG Project Auth Bypass Vulnerability

CVE-2026-47688 Overview

CVE-2026-47688 is a missing authorization vulnerability [CWE-862] in FOG Project, a free open-source cloning, imaging, rescue, and inventory management system. The flaw affects the clearAES and clearPMTasks methods in FOGPage, which are exposed through the public client node endpoint. An unauthenticated remote attacker can invoke either method with a single HTTP GET request. No login, session, or CSRF token is required. Successful exploitation wipes host AES encryption credentials and deletes all power management scheduled tasks across managed hosts. FOG Project released fixes in versions 1.5.10.1832 and 1.6.0-beta.2313.

Critical Impact
Unauthenticated remote attackers can destroy AES encryption credentials and delete all power management scheduled tasks on managed hosts via a single unauthenticated HTTP GET request.

Affected Products

FOG Project versions prior to 1.5.10.1832 (1.5.x branch)
FOG Project versions prior to 1.6.0-beta.2313 (1.6.x beta branch)
Deployments exposing the FOG client node endpoint to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-47688 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47688

Vulnerability Analysis

FOG Project exposes a client node endpoint intended to serve FOG client agents running on managed hosts. This endpoint routes into FOGPage handler methods, including clearAES and clearPMTasks. Both handlers execute destructive server-side state changes but do not enforce authentication, session validation, or anti-CSRF checks before running.

The clearAES handler removes AES encryption credentials stored for a host. These credentials protect data exchanged between the FOG server and its clients. The clearPMTasks handler deletes all scheduled power management tasks, disrupting planned wake, shutdown, and reboot operations across the imaging fleet.

Because both methods respond to unauthenticated HTTP GET requests, an attacker with network reach to the FOG server can trigger repeated destructive operations at scale.

Root Cause

The root cause is a missing authorization check [CWE-862] on handler methods reachable through the public client node. The client endpoint is designed to accept traffic without user login because FOG agents connect anonymously. Administrative-class methods such as clearAES and clearPMTasks were inadvertently reachable through the same code path without a permission gate.

Attack Vector

The attack vector is network-based with low complexity. An attacker sends a crafted HTTP GET request to the FOG client endpoint, specifying the vulnerable method through the request parameters. No credentials, cookies, or CSRF tokens are validated. Because the trigger is a GET request, exploitation can also be achieved through browser-driven request forgery when an administrator visits an attacker-controlled page. Consult the GitHub Security Advisory GHSA-95pr-mcrf-x2qg for full technical details.

Detection Methods for CVE-2026-47688

Indicators of Compromise

Unexpected HTTP GET requests to the FOG client node endpoint referencing clearAES or clearPMTasks method parameters
Hosts in the FOG database with AES encryption credentials suddenly cleared or reset
Power management task tables emptied without corresponding administrator activity in FOG audit logs
Requests to the FOG server originating from IPs outside the managed imaging subnet

Detection Strategies

Parse FOG web server access logs (Apache or Nginx) for GET requests to the client endpoint containing clearAES or clearPMTasks parameter values
Correlate database-level changes to AES credential and power management task tables against authenticated administrator sessions
Alert on any unauthenticated request that mutates state, treating GET-triggered modifications as a signal of misuse

Monitoring Recommendations

Forward FOG server web and application logs to a centralized log platform for retention and query
Baseline normal client endpoint traffic patterns and alert on anomalous method invocations or source IPs
Monitor FOG database schema tables tied to AES credentials and scheduled power tasks for unexpected deletions

How to Mitigate CVE-2026-47688

Immediate Actions Required

Upgrade FOG Project to version 1.5.10.1832 on the stable branch or 1.6.0-beta.2313 on the beta branch
Restrict network access to the FOG server so only managed imaging subnets can reach the client endpoint
Audit AES credential and power management task tables to confirm they have not been tampered with prior to patching

Patch Information

FOG Project fixed the missing authorization issue in versions 1.5.10.1832 and 1.6.0-beta.2313. The patched releases add authorization enforcement to the clearAES and clearPMTasks handlers so they can no longer be invoked through the unauthenticated client node path. Patch details are published in the FOG Project GitHub Security Advisory GHSA-95pr-mcrf-x2qg.

Workarounds

Place the FOG server behind a firewall or reverse proxy that blocks external access to the client endpoint until patching completes
Apply web server access control rules that reject requests containing clearAES or clearPMTasks parameters on the client path
Isolate the FOG server on a management VLAN that is unreachable from user workstations and the internet

bash

# Example Apache location block to deny external access to the FOG client endpoint
# until upgrade to 1.5.10.1832 or 1.6.0-beta.2313 is complete
<Location "/fog/management/index.php">
    Require ip 10.10.20.0/24
</Location>
<LocationMatch "/fog/client/.*(clearAES|clearPMTasks).*">
    Require all denied
</LocationMatch>