Red Hat Satellite EUVD-2026-97236

Exploitation requires an authenticated Foreman/Red Hat Satellite 6 account that already holds a host view permission AND the ability to view a domain or subnet that is shared across multiple hosts; the flaw is reached through the domain/subnet interface API, which applies the permission but ignores its search-limit filter. Disclosure of out-of-scope host interface records occurs under these conditions alone. The additional write impact (persisting a change to another host's interface) is limited to callers who also hold host-edit permission. Limiting factors: the attacker cannot be fully unauthenticated (PR:L - a provisioned user and relevant host/subnet permissions are prerequisites), there is no scope change (S:U), no availability impact, and the shared domain/subnet must exist for cross-host leakage to occur.

This is a moderate-severity broken-access-control issue (CWE-863) with a vendor-provided CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4). The network attack vector and low complexity are offset by the PR:L requirement: the actor must already be an authenticated, provisioned user with permission to view some hosts and to view a domain or subnet shared with other hosts - this is an insider/over-privileged-tenant problem, not a pre-auth internet exploit. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Impact is bounded (C:L/I:L, A:N): disclosure of interface records for hosts outside the caller's search scope, and - only if the caller also holds host-edit permission - modification of those out-of-scope interfaces. This reads as a genuine multi-tenant/RBAC data-segregation defect worth patching in shared Satellite/Foreman deployments, but it is a priority-after-criticals issue rather than an emergency: the privilege prerequisite and partial impact keep real-world risk firmly in the medium band, consistent with the 5.4 score.

A low-privileged but authenticated Foreman/Satellite user who is permitted to view a handful of hosts and a shared subnet calls the subnet (or domain) interfaces API. Because the server checks only that the caller holds a host permission and ignores that permission's search limit, the response returns interface records for every host on that subnet - including hosts the user cannot otherwise see. If the same user also holds host-edit rights, they submit a modification to one of those leaked interfaces and it is persisted. No public exploit code was provided in the input.