In the foreman HTTP proxy configuration, unvalidated test_url parameters permit an attacker to direct the Foreman instance to arbitrary URLs. By exploiting this flaw, an attacker can perform a server‑side request forgery to connect to the metadata services that cloud platforms expose internally. This enables theft of sensitive data such as instance identity tokens, secret credentials, and other metadata. The issue is a classic SSRF, mapped to CWE‑918, and its impact is primarily the confidentiality compromise of privileged cloud information.

The vulnerability affects Red Hat Satellite 6. The foreman component included in the Satellite 6 distribution contains the flaw. Specific version details are not provided by the CNA, so all deployments of the affected component may be vulnerable until an update is applied.

The CVSS score of 4.4 indicates low‑to‑medium severity, and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog, implying no widespread exploitation has been publicly documented. Nonetheless, environments that run the affected Foreman instance can be compromised if an attacker gains access to the Foreman API; they can then craft requests that cause Foreman to reach internal metadata endpoints. Because the attacker does not need privileged credentials to the target environment, the practical risk remains notable for cloud workloads.