Red Hat Satellite CVE-2026-92904

Requires an authenticated Foreman/Red Hat Satellite 6 account whose view_job_invocations visibility is limited by a permission filter, and requires the foreman_remote_execution plugin to be installed and in use. Exploitation is confined to job invocations within the attacker's own organization(s) - cross-organization data is not exposed. Limiting factors: valid low-privileged credentials are needed (PR:L), the attacker must enumerate/guess valid job invocation IDs, and impact is read-only disclosure with no integrity or availability effect.

This is a genuine but low-to-moderate authorization flaw, not a high-urgency issue. The vendor CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the description: an already-authenticated Satellite/Foreman user with a restricted view_job_invocations permission filter bypasses that filter for the show_template_invocation_by_host action via direct object reference (CWE-863 / IDOR). All three limiting signals point the same direction - network reachable but requires valid low-privileged credentials (PR:L), no user interaction, confidentiality-only impact bounded to the caller's own organizations, and no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. One point worth flagging for defenders: the description says the exposed data includes 'live output, rendered script, and input values' of other users' job invocations - rendered remote-execution scripts and job inputs routinely carry secrets (credentials, tokens, connection strings), which is why C:L arguably understates confidentiality (a case for C:H). Net: real, verifiable, but a patch-in-normal-cycle item rather than an emergency, absent evidence of active exploitation.

A low-privileged Satellite user whose job-invocation visibility is deliberately scoped by a permission filter iterates job invocation IDs and requests show_template_invocation_by_host for IDs belonging to other users in the same organization. Because the action resolves the record by ID without re-applying the view_job_invocations filter, the attacker reads the live output, rendered script, and input values - potentially harvesting secrets embedded in other teams' remote-execution jobs. No public exploit code is identified, but the attack requires only an authenticated session and simple ID enumeration.