EUVD-2026-40281
GHSA-f274-c23v-hx4j
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Web controller is network-reachable (AV:N); scope change applies as forged requests exit to cloud metadata infrastructure (S:C); PR:H retained as admin access is required.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component.
AnalysisAI
Server-Side Request Forgery (SSRF) in Foreman's HTTP proxy controller within Red Hat Satellite 6 allows high-privileged attackers to redirect internal HTTP requests to cloud metadata endpoints on AWS, GCP, and Azure environments. By manipulating HTTP parameters in the http_proxies_controller or http_proxy configuration files, an attacker can cause the Foreman server to issue forged requests to internal metadata services (e.g., AWS IMDS at 169.254.169.254), potentially harvesting IAM role credentials, access tokens, and environment configuration secrets. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the confidentiality impact is high given the value of cloud metadata credentials.
Technical ContextAI
Foreman is an open-source lifecycle management tool for servers and the upstream engine powering Red Hat Satellite 6 (CPE: cpe:2.3:a:red_hat:red_hat_satellite_6:*). The affected code paths are the http_proxies_controller (a Rails controller managing proxy configurations) and associated http_proxy configuration files. The root cause is CWE-918 (Server-Side Request Forgery): user-controlled HTTP parameters specifying proxy targets are not sufficiently validated or restricted, allowing an attacker to designate internal link-local addresses - such as the AWS Instance Metadata Service (IMDS) at 169.254.169.254, GCP's metadata.google.internal, or Azure's equivalent - as proxy destinations. When Foreman processes these parameters, it issues outbound HTTP requests from the server itself to those internal endpoints, returning responses that can include IAM instance profile credentials, access tokens, and environment metadata inaccessible from outside the cloud VPC.
RemediationAI
No patched version number has been confirmed in the available data - the Red Hat Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2490345) and the security advisory at https://access.redhat.com/security/cve/CVE-2026-13316 should be monitored for a fixed package release. As a specific compensating control, restrict the HTTP proxy configuration feature in Foreman to the minimum required set of trusted proxy destinations using allowlist-based URL validation, preventing specification of link-local ranges (169.254.0.0/16) and internal metadata hostnames. Additionally, where cloud network controls permit, enforce IMDSv2 (requiring session-oriented token requests) on all EC2 instances running Satellite, which raises the bar for metadata credential theft even if SSRF is achieved. Limit Foreman/Satellite administrative access to the smallest possible set of accounts and audit admin-level proxy configuration changes via Satellite's auditing subsystem. Note that disabling the HTTP proxy feature entirely may impact Satellite's ability to reach external content sources.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today