Foreman: excessive permissions for viewer role on preview
Summary
| CVE | CVE-2026-96659 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-01 17:17:35 UTC |
| Updated | 2026-10-16 13:33:44 UTC |
| Description | A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS: 0.003220000 probability, percentile 0.230980000 (date 2026-10-06)
Problem Types: CWE-267 | CWE-267 Privilege Defined With Unsafe Actions
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L |
| 3.1 | CNA | CVSS | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
| Application | Redhat | Satellite | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Satellite 6.16 For RHEL 8 | unaffected 0:3.12.0.23-1.el8sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.16 For RHEL 9 | unaffected 0:3.12.0.23-1.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:3.14.0.22-1.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:3.2.13-1.el9pc * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:3.1.62-1.el9pc * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:5.3.1-2.el9pc * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:0.6.0-1.el9pc * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:15.0.2-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:3.14.0-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:4.16.0.20-1.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:1.5.0-2.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:6.17.12-1.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.17 For RHEL 9 | unaffected 0:0.1.0-2.1.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.18 For RHEL 9 | unaffected 0:3.16.0.25-1.el9sat * rpm | Not specified |
| CNA | Red Hat | Red Hat Satellite 6.19 For RHEL 9 | unaffected 0:3.18.0.14-1.el9sat * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:74506 | [email protected] | access.redhat.com | Vendor Advisory |
| www.openwall.com/lists/oss-security/2026/10/07/1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Patch, Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:74505 | [email protected] | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:74504 | [email protected] | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:74503 | [email protected] | access.redhat.com | Vendor Advisory |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| access.redhat.com/security/cve/CVE-2026-96659 | [email protected] | access.redhat.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-17T20:53:34.569Z | Reported to Red Hat. |
| CNA | 2026-10-01T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Keeping the Foreman Safemode protection enabled (the default configuration) limits the risk of remote code execution via this flaw, but does not prevent the underlying information disclosure. Updated foreman packages addressing this issue are delivered through Red Hat Satellite errata; users should apply the relevant Satellite updates.
There are currently no legacy QID mappings associated with this CVE.