EUVD-2026-41002
GHSA-h2gj-g5gx-f7qq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network API access with low-privilege auth (view_keypairs role) required; pure confidentiality impact via private SSH key exfiltration; no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
AnalysisAI
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_keypairs' permission to bypass taxonomy scoping and retrieve private SSH keys belonging to foreign organizations by directly querying key pair IDs via the API. The flaw is an IDOR (CWE-639) at the multi-tenancy enforcement layer, meaning the isolation contract between tenant organizations is broken for any user granted that permission. No CISA KEV listing or public exploit code has been identified at time of analysis; impact is strictly confidentiality - no write or destructive capability is exposed through this path.
Technical ContextAI
Foreman is an open-source infrastructure lifecycle management platform; Red Hat Satellite 6 is its enterprise distribution, confirmed affected via CPE cpe:2.3:a:red_hat:red_hat_satellite_6:*:*:*:*:*:*:*:*. Taxonomy scoping is Foreman's multi-tenancy mechanism that restricts resource visibility by organization and location context - hosts, compute resources, and key pairs are all gated by this boundary. The key pair feature stores private SSH keys used for host provisioning and automation against managed infrastructure. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the application performs permission checks (confirming the user holds 'view_keypairs') but fails to enforce that the requested object's organization matches the requester's authorized taxonomy context. This is a classic IDOR pattern where sequential or guessable resource identifiers (key pair IDs) are accepted without object-level ownership validation, allowing cross-tenant data leakage.
RemediationAI
Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-5142 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2452999 to obtain the patched release; no specific fixed version number was confirmed in available intelligence and must be verified directly against the Red Hat advisory before deployment. As an immediate compensating control, administrators should audit the 'view_keypairs' permission across all Satellite roles and user accounts, revoking it from any account that does not operationally require keypair visibility - this eliminates the exploitable permission surface entirely. For deployments where cross-tenant key access cannot be ruled out historically, rotation of all stored SSH key pairs for potentially affected organizations is advisable, as exfiltrated private keys remain valid until revoked on managed hosts. Network-layer restriction of Satellite API access to trusted management IP ranges (firewall ACLs) further reduces exposure at the cost of limiting remote administrative workflows. No side effect applies to the permission audit unless automation workflows depend on non-admin accounts holding 'view_keypairs'.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across org
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today