EUVD-2026-41004
GHSA-47r2-h2mh-qqjp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible API requires authenticated low-privileged user (PR:L); impact is confidentiality-only on infrastructure metadata with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
AnalysisAI
Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding host-edit permissions to retrieve sensitive infrastructure metadata from organizations and locations they are not authorized to access. The root cause is the taxonomy_scope controller method accepting organization and location IDs from nested request parameters without validating them against the caller's authorized tenancy scope, implementing a textbook CWE-639 authorization bypass through user-controlled key. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis; however, the low attack complexity and lack of user interaction make this straightforward to exploit for any low-privileged authenticated user in multi-tenant Satellite deployments.
Technical ContextAI
Foreman is an open-source lifecycle management tool for physical and virtual infrastructure; Red Hat Satellite 6 is its enterprise-supported distribution, identified by CPE cpe:2.3:a:red_hat:red_hat_satellite_6:*:*:*:*:*:*:*:*. Foreman uses a taxonomy model - organizations and locations - to implement multi-tenancy, scoping resources so that users in one organization cannot see another's infrastructure. The taxonomy_scope controller method is responsible for applying these tenant boundaries to resource queries. The flaw, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), occurs because this method accepts organization and location IDs embedded in nested HTTP request parameters without cross-checking them against the authenticated user's permitted taxonomy scope. An attacker can substitute foreign organization or location IDs into these nested parameters, causing the controller to scope queries against an unauthorized tenant and return its infrastructure metadata.
RemediationAI
Apply the vendor-supplied patch referenced in the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-5138; an exact fixed version number was not included in the provided data and should be confirmed directly from that advisory before patching. No patch version has been independently verified from the available input. If patching is not immediately feasible, the most actionable compensating control is to audit and minimize the set of users holding host-edit permissions, particularly in multi-tenant deployments, since exploitation requires that specific permission. Additionally, segment Satellite instances per organization rather than running a shared multi-tenant instance, which eliminates the cross-tenant leakage surface entirely at the cost of increased operational overhead. Network-layer controls on Satellite API access (restricting the management interface to trusted administrator networks) reduce exposure to opportunistic internal attackers but do not remediate the underlying authorization bypass.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today