A flaw in the foreman-mcp-server component allows an attacker to hijack active administrative sessions. The server irresponsibly caches authenticated client connections, trusts a non‑secret session identifier, and logs all new session IDs to standard logs. This defect leads to privilege escalation and potentially code execution across the managed infrastructure. The weakness corresponds to CWE‑287: Improper Authentication.

Red Hat Satellite 6 is affected. The vulnerability exists specifically within the foreman‑mcp‑server service bundled with this distribution.

The CVSS score of 7.8 marks the issue as high severity. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated user sending requests containing a legitimate session ID that they obtain from logs or other sources. Once the session is hijacked, the attacker gains elevated privileges and can execute code throughout the managed network. No practical interim workaround has been identified; the recommended response is to update to the patched package as soon as it becomes available.