Proxy::Dynflow::Api selects authorize_with_token from the path alone. If the Authorization header is absent, that method returns false and does not halt. A Sinatra before filter ignores the return value, so POST /dynflow/tasks/<uuid>/update and /done reach dispatch_external_event. A second bypass sits in the same check: OtpManager.authenticate treats a Basic token with no colon as otp = nil, and passwords[username] == nil is true when that task has no stored OTP. generate_otp has no production caller on current smart_proxy_remote_execution_ssh 1.0.x. On 0.11.x it is called only by PollingScriptRunner, and only in async-SSH mode. Omitting the header still bypasses that case.

This does not launch jobs. In the default :ssh mode, Runner::Base#external_event refreshes and drops the payload. In :pull and :'pull-mqtt', PullScript#process_external_event stores the caller’s output and exit_code, and exit code 0 is recorded as success. 

On Satellite 6.16–6.18, async-SSH PollingScriptRunner#external_event can also apply the payload when manual_mode is set. That runner was removed in smart_proxy_remote_execution_ssh 1.0.0 (commit d8d1811, 2025-11-28). 

The attacker must already know a live execution-plan UUID. Step ids are small integers. The console flaw below is what gives those UUIDs to a host that holds a CA-signed certificate.

Likely to be introduced in smart_proxy_dynflow 0.4.0 by commit e205e19.