by Kastro CVE-2026-96659
Red Hat Red Hat Satellite 6.16 for RHEL 8 — Foreman: excessive permissions for viewer role on preview
Description · from the CVE record
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Affected
ProductAffectedFixed inSource
Red Hat Satellite 6.16 for RHEL 8see advisory0:3.12.0.23-1.el8satCNA
Red Hat Satellite 6.16 for RHEL 9see advisory0:3.12.0.23-1.el9satCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:3.14.0.22-1.el9satCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:3.2.13-1.el9pcCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:3.1.62-1.el9pcCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:5.3.1-2.el9pcCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:0.6.0-1.el9pcCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:15.0.2-2.el9satCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:3.14.0-2.el9satCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:4.16.0.20-1.el9satCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:1.5.0-2.el9satCNA
Red Hat Satellite 6.17 for RHEL 9see advisory0:6.17.12-1.el9satCNA
Scores by source
redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial