CVE-2021-20260

CVE-2021-20260 affects the Foreman project, specifically the Datacenter plugin, where the API exposes the password to an authenticated local attacker with the view_hosts permission. This yields potential impacts to confidentiality, integrity, and availability. The NVD entry rates it as high (CVSS...

CVE-2023-0118

CVE-2023-0118 : The vulnerability affects Foreman, where an admin user can bypass safe mode in templates and execute arbitrary code on the underlying OS. The documented impact is critical (CVSS v3.1 base score 9.1, all impact metrics High). Connected advisories reference Red Hat Satellite/Foreman...

CVE-2023-0462

CVE-2023-0462 is a Foreman-related arbitrary code execution vulnerability. The flaw allows an admin to execute arbitrary OS code by supplying a YAML payload in global parameters, enabling code execution within the Foreman/Satellite context. Connected advisories show multiple Red Hat Satellite/For...

CVE-2023-4886

CVE-2023-4886 affects Foreman (reported in Red Hat Satellite advisories). The issue is a world-readable Tomcat server.xml containing candlepin keystore/truststore passwords, enabling sensitive data exposure locally. Public references indicate Foreman is the affected component and list this CVE am...

CVE-2021-3584

CVE-2021-3584 is a server-side remote code execution in the Foreman project. An authenticated attacker can abuse Sendmail configuration options to overwrite defaults and perform command injection, impacting confidentiality, integrity, and availability. According to the primary sources, fixed rele...

CVE-2021-3494

CVE-2021-3494 affects the Foreman smart proxy’s FreeIPA module, where SSL certificate verification is not performed. This enables a potential Man-in-the-Middle attack if conditions are met, compromising confidentiality. Affected: Foreman/smart proxy versions before 2.5.0 (per NVD OSV notes). The ...

CVE-2021-3469

CVE-2021-3469 affects Foreman prior to 2.3.4 and prior to 2.4.0, due to an improper authorization handling flaw that lets an authenticated attacker impersonate the foreman-proxy when the Puppet CA is configured to sign certificate requests containing SANs. Foreman does not enable SANs by default,...

CVE-2018-1096

Foreman prior to version 1.16.1 is affected by an input sanitization flaw in the id field of the dashboard controller that enables SQL injection against the back-end database. Affected component: Foreman dashboard controller (id parameter). Root cause: insufficient input sanitization leading to a...

CVE-2016-9593

CVE-2016-9593 affects foreman-debug; the vulnerability arises from missing obfuscation of sensitive information in logging. An attacker with access to the foreman log file could view passwords, enabling credential exposure and potential system access. Public references indicate the issue is tied ...

CVE-2017-2672

Foreman vulnerability CVE-2017-2672 affects Foreman prior to version 1.15, in the logging of adding and registering images. An attacker with access to the Foreman log file could view passwords for provisioned systems, enabling unauthorized access. No exploitation vector details are provided beyon...

CVE-2016-8639

The CVE-2016-8639 entry refers to a stored XSS vulnerability in Foreman prior to version 1.13.0, exploitable via setting an organization or location name to include arbitrary HTML/JavaScript. Affected component is Foreman’s web interface, with the underlying issue being HTML/input handling in org...

CVE-2017-15100

CVE-2017-15100 is a stored XSS vulnerability in Foreman triggered when a remote attacker submits facts containing HTML. The issue affects the Foreman web pages that render facts on the Facts, Trends, and Statistics views. Red Hat’s RHSA-2018:2927 (Satellite 6.4) includes this CVE among others and...

CVE-2018-1097

CVE-2018-1097 affects Foreman prior to 1.16.1. The vulnerability allows users with limited permissions for powering Ovirt/RHV hosts on and off to discover the credentials (username and password) used to connect to the compute resource. Exploitation details are not provided in the connected docume...

CVE-2016-7077

CVE-2016-7077 affects Foreman prior to version 1.14.0, where the form helper does not authorize options for associated objects. This information disclosure allows an unauthorized user to see the names of those objects when their count is less than six. The vulnerability is documented with CVSS sc...

CVE-2020-10710

CVE-2020-10710 affects Red Hat Satellite components (Candlepin) where the plaintext Candlepin password can be disclosed during updates via the satellite-installer. The flaw enables an attacker with sufficiently high privileges (e.g., root) to retrieve the Candlepin plaintext password, with confid...

CVE-2018-16861

CVE-2018-16861 is a stored XSS in the Foreman component of Red Hat Satellite, exploitable when a user with privileges creates entities via Hosts, Monitor, Infrastructure, or Admin menus. The issue allows an attacker to inject scripts that run in other users’ browsers and could lead to theft of an...

CVE-2026-5142

CVE-2026-5142 (Foreman) : A flaw allows authenticated users with the low-privilege permission view_keypairs to bypass taxonomy scoping and download private SSH keys from other organizations by querying key pair IDs. This results in cross-tenant data exposure in multi-tenant deployments. The initi...

CVE-2017-7535

Foreman prior to version 1.16.0 is vulnerable to a stored XSS in the organizations/locations assignment to hosts. Exploitation requires a user to assign hosts to an organization whose name contains HTML, which is visible to the user before action is taken. The CVE is documented across multiple so...

CVE-2026-5136

Summary : CVE-2026-5136 affects Foreman. A flaw in the Usergroup model allows an authenticated user with usergroup management permissions to attach arbitrary roles (including administrator) to a user group and then add themselves as a member, enabling full privilege escalation to administrator-le...

CVE-2026-5138

Foreman vulnerability CVE-2026-5138 involves the taxonomy_scope controller failing to validate organization and location IDs in nested request parameters. An authenticated user with host-edit permissions can trigger cross-tenant information disclosure, leaking sensitive infrastructure metadata (s...

CVE-2026-5135

CVE-2026-5135 concerns Foreman and describes a broken access control vulnerability where an authenticated user with host-edit permissions can retarget an existing lookup value override to a different host by modifying the match field via nested host attributes, effectively bypassing authorisation...