EUVD-2026-41003
GHSA-vpj3-792h-v855
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
PR:L confirmed as host-edit role is required; I:H reflects unauthorized modification of managed host configurations; no confidentiality or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
AnalysisAI
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host-edit permissions to retarget an existing lookup value override to hosts outside their authorized organizational or location scope. The flaw stems from insufficient authorization enforcement on the match field when modified via nested host attributes, allowing an attacker to effectively write configuration overrides to managed hosts they are not permitted to administer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Foreman's smart variable and class parameter override system uses lookup values to assign host-specific configuration data; the match field in these overrides determines which host or host group receives a given value. CWE-639 (Authorization Bypass Through User-Controlled Key) describes exactly this failure mode: the authorization decision relies on a user-controllable key (the match field), and the application fails to re-validate that the resolved target host falls within the requestor's permitted scope. By crafting the match field through nested host attributes in the API request, an attacker can redirect an existing override to an arbitrary host without triggering the intended access control gate. The affected product is identified by CPE cpe:2.3:a:red_hat:red_hat_satellite_6:*:*:*:*:*:*:*:*, indicating all currently tracked versions of Red Hat Satellite 6 inherit this flaw from the Foreman component.
RemediationAI
Patch available per vendor advisory - consult https://access.redhat.com/security/cve/CVE-2026-5135 for the specific errata and fixed Satellite build, as no exact patched version number was present in the available data. Until a patch is applied, compensating controls should focus on restricting host-edit permission grants to the minimum required set of users, since the vulnerability requires that role. Administrators should audit current role assignments to identify any users who hold host-edit permissions beyond their intended organizational scope. In Satellite deployments with strict multi-tenancy requirements, temporarily restricting API access to the Satellite web service to trusted network segments reduces remote exploitability (AV:N) without impacting core functionality for managed hosts using internal communication channels. Note that restricting API access does not eliminate the vulnerability for users operating within the permitted network segment.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across org
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today