EUVD-2026-66996
GHSA-p76g-9c4w-2889
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible API endpoint requiring only a low-privilege account; read-only IDOR with no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.
AnalysisAI
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across organizational and location boundaries due to missing object-level authorization (IDOR/BOLA, CWE-639). An authenticated user holding any template-related permission - as minimal as view_ptables - can retrieve audit-history revisions owned by other organizations simply by supplying a guessable audit ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid Satellite account with at least one template-related permission such as view_ptables - this is a low-privilege role commonly assigned to operators; (2) network access to the Foreman/Satellite web interface (AV:N per CVSS vector); (3) knowledge or enumeration of at least one audit ID belonging to a template in a different organization or location. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a network-accessible, low-complexity, low-privilege read-only flaw with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Satellite user with minimal view_ptables permission queries the template revision audit endpoint with incrementing integer audit IDs. By iterating through IDs, the attacker retrieves historical template contents belonging to other organizations or locations within the same Satellite instance, potentially harvesting credentials or private configuration data embedded in those templates. … |
| Remediation | Apply the vendor-released patch from Red Hat once available via the Satellite errata channel; consult https://access.redhat.com/security/cve/CVE-2026-81658 for the specific advisory and fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacema
Cleartext credential persistence in foreman-mcp-server, a component of Red Hat Satellite 6, exposes session identifiers
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today