1411 matches found
CVE-2026-1961-foreman-poc
Foreman WebSocket Proxy Command Injection CVE-2026-1961 — PoC Proof-of-concept for a command injection vulnerability in Foreman's WebSocket proxy lib/wsproxy.rb, disclosed responsibly to Red Hat and patched. Summary Foreman's WebSocket proxy interpolates an unsanitized host value, sourced from a...
Exploit for CVE-2026-107360
CVE-2026-107360 — rubygem-safemode compound-assignment Jail al...
foreman: API filter lookup ignores a search-limited filter permission
A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filte...
foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController
A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...
foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAwarefinduser using User.findparams:userid without enforcing the required parent-user authorization check. An attacker with the createsshkeys permission can exploit this...
foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...
foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix)
A flaw was found in Foreman. An authenticated user with viewhosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened th...
foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...
foreman: API filter lookup ignores a search-limited filter permission
A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filte...
foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAwarefinduser using User.findparams:userid without enforcing the required parent-user authorization check. An attacker with the createsshkeys permission can exploit this...
foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix)
A flaw was found in Foreman. An authenticated user with viewhosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened th...
foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController
A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...
foreman: API filter lookup ignores a search-limited filter permission
A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filte...
foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
Critical: Red Hat Security Advisory: Satellite 6.16.15 Async Update
An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix)
A flaw was found in Foreman. An authenticated user with viewhosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened th...
foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController
A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...
foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAwarefinduser using User.findparams:userid without enforcing the required parent-user authorization check. An attacker with the createsshkeys permission can exploit this...