EUVD-2026-90920
GHSA-2fj2-wwpq-f5jr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Any authenticated Viewer (PR:L) can trigger it remotely with low complexity (AV:N/AC:L); disclosure of managed-host credentials crosses a security boundary (S:C, C:H), with command execution conditional and non-default (I:L/A:L).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
AnalysisAI
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit template preview endpoints to disclose sensitive data, including host root passwords. In non-default configurations where Safemode protections are disabled, the flaw can escalate to arbitrary command execution as the Foreman system account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Foreman/Red Hat Satellite account with at least low-level Viewer permissions; the attacker then abuses the template preview endpoints to read sensitive data including host root passwords. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a CVSS-inflated paper risk, but its severity hinges on privilege context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch referenced in Red Hat errata RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503) for Red Hat Satellite 6.19 for RHEL 9; upstream Foreman users should apply the corresponding upstream fix when available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Satellite 6.19 and upstream Foreman deployments, determine whether Safemode protections have been disabled in any instance (a non-default and risk-elevating state), re-enable Safemode wherever it has been turned off, and reduce Viewer role assignments to only those users who strictly require read access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management perm
Same weakness CWE-267 – Privilege Defined With Unsafe Actions
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today