Red Hat Satellite CVE-2026-5138

Exploitation requires an active authenticated session with at minimum host-edit permissions assigned in Foreman/Red Hat Satellite 6. The attacker must be able to reach the Satellite web API over the network (AV:N confirmed by CVSS vector). The vulnerability is specifically triggered by injecting foreign organization or location IDs into nested request parameters targeting the taxonomy_scope controller - exploitation is only meaningful in deployments with two or more distinct organizations or locations configured (i.e., multi-tenant Satellite instances). Limiting factors: unauthenticated attackers cannot exploit this; users without host-edit permissions cannot exploit this; single-organization Satellite deployments have no cross-tenant data to disclose. There is no user interaction required beyond the attacker's own crafted request.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a moderate information-disclosure-only vulnerability. The low attack complexity and absence of required user interaction mean that any authenticated low-privileged user could deterministically trigger the issue. However, the scope is contained: there is no integrity or availability impact, and exploitation is limited to read access on infrastructure metadata. No EPSS score was provided in the input data - probability of exploitation cannot be quantified from available signals. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, indicating it has not been actively weaponized at scale. Real-world risk is highest in multi-tenant Satellite deployments shared across multiple business units or managed service provider environments where tenant isolation is a contractual or compliance requirement; in single-organization deployments, the cross-tenant leakage has no practical target. The disclosed metadata (subnet topology, VLAN IDs, DNS servers, IP ranges, gateways) is valuable for reconnaissance and lateral movement planning but does not itself provide direct system compromise.

An authenticated Satellite user in Organization A, assigned host-edit permissions for legitimate administrative duties, constructs an HTTP request to the Foreman taxonomy_scope endpoint with nested parameters containing the organization and location IDs of Organization B. The controller processes these user-supplied IDs without validating them against the caller's authorized taxonomy, scopes its infrastructure query to Organization B, and returns subnet topology, IP address ranges, gateway addresses, DNS server addresses, and VLAN IDs belonging to that separate tenant. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP request manipulation - no exploit tooling is needed.