What is the CVSS score of CVE-2026-5136?

CVE-2026-5136 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Red Hat Satellite are affected by CVE-2026-5136?

Red Hat Satellite 6 (Foreman) contains a privilege escalation vulnerability in its role-based access control system that allows authenticated users with usergroup-management permissions to assign…. A patch is available.

How to fix or mitigate CVE-2026-5136?

24 hours: Audit all users with usergroup-management permissions and review recent Usergroup role assignments for suspicious activity; implement immediate restrictions on who can assign this capability. 7 days: Deploy enhanced logging and alerting for Usergroup modifications and role-change events; contact Red Hat for patch availability and timeline. 30 days: Execute a vendor-directed patching plan or implement network isolation of affected Satellite instances if no patch is released; document compensating control effectiveness for audit.

Red Hat Satellite CVE-2026-5136

EUVD-2026-40959 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-01 redhat

GHSA-fpxf-rppp-4373

Privilege Escalation Red Hat Red Hat Satellite 6 Red Hat

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-facing web app (AV:N), no special timing (AC:L); attacker needs a delegated usergroup-management account so PR:L not PR:N; escalation to full admin yields C/I/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:21 vuln.today

DescriptionCVE.org

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.

AnalysisAI

Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-management permissions attach arbitrary roles - including the administrator role - to a user group and then enroll themselves, gaining full admin-level control. The Usergroup model fails to validate that the assigning user actually holds the roles being granted, breaking the RBAC delegation boundary. Rated CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and clear escalation path make it a strong patch priority.

Technical ContextAI

Foreman is an open-source lifecycle-management platform for provisioning and configuring physical and virtual servers; Red Hat Satellite 6 is the supported downstream distribution of Foreman plus Katello. Foreman implements role-based access control (RBAC) in which users and user groups are granted roles that bundle permissions. The flaw is CWE-266 (Incorrect Privilege Assignment): the Usergroup model does not enforce that the roles a user attempts to assign are a subset of the roles/permissions the calling user already holds. This missing privilege-subset check on role assignment lets a delegated administrator scoped only to manage user groups escalate beyond their granted authority. The affected component is identified in the supplied CPE as cpe:2.3:a:red_hat:red_hat_satellite_6.

RemediationAI

No vendor-released patch version was identified in the provided data, so apply the fix referenced by Red Hat once published - monitor https://access.redhat.com/security/cve/CVE-2026-5136 and https://bugzilla.redhat.com/show_bug.cgi?id=2452970 for the errata and exact fixed package version, then upgrade to it. As an immediate compensating control, audit and revoke usergroup-management permissions from any non-administrative roles so only trusted admins can modify user groups, since the vulnerability is only reachable by users holding that permission (trade-off: this disrupts legitimate delegated user-group administration). Additionally, enable and review audit logging for role-assignment and user-group membership changes to detect attempts to attach the administrator role, and periodically reconcile which accounts hold admin roles to catch unauthorized escalation.