Foreman Ansible plugin EUVD-2026-81418

Requires an authenticated Foreman/Red Hat Satellite 6 account whose host visibility is intentionally narrowed by a view_hosts permission filter, and the foreman_ansible plugin must be installed and its Ansible inventory API in use. The attacker must supply host IDs that belong to their own organization but fall outside their permission filter - cross-organization access is not implied, which limits the scope. Limiting factors: valid low-privilege credentials are needed (PR:L), impact is confidentiality-only (read of inventory/hidden parameters, no modification), and the leak is bounded to in-organization hosts. Value of disclosed data depends on whether hidden parameters store secrets in the target deployment.

This is a genuine but modest-severity broken-authorization (IDOR) issue, correctly categorized as CWE-863. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) is internally consistent with the description: network-reachable API, low complexity, requires an authenticated low-privilege account, no user interaction, confidentiality-only impact. No EPSS score, KEV entry, or public POC is present in the provided intelligence - exploitation status is 'no public exploit identified at time of analysis.' The one point of tension is the C:L rating: the description explicitly notes disclosure of 'parameter values marked as hidden,' which in Foreman/Ansible typically hold secrets (passwords, tokens); if those hidden parameters contain sensitive credentials, C:H would be defensible and push the score higher. Offsetting that, the disclosure is scoped to hosts within the attacker's own organization and requires a pre-existing authenticated account with a restrictive permission filter, so the practical blast radius is bounded. Net: a real, valid finding worth patching in Satellite/Foreman fleets, but a low-priority (medium-CVSS, no active-exploitation signal) issue rather than an urgent one - the CWE-863 authorization-bypass class is not the mass-exploited RCE category attackers automate.

An authenticated Satellite/Foreman user who has been deliberately restricted by a view_hosts permission filter (e.g., allowed to see only a subset of hosts) calls the foreman_ansible inventory API and supplies host IDs for machines outside their filter but inside their organization. Because the controller uses an unscoped Host.where lookup, it returns the full Ansible inventory for those hosts - including hidden parameter values - leaking configuration and potentially secret data the user was never authorized to view. No public exploit code is identified at time of analysis.