Description
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Published: 2026-07-01
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated user with host‑edit permissions can exploit a flaw in Red Hat Satellite’s Foreman component. The issue is a CWE‑639 weakness where the taxonomy_scope controller does not validate nested organization and location identifiers, allowing the user to bypass existing authorization checks. As a result, the attacker can disclose sensitive infrastructure metadata—such as subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs—from organizations and locations that the user is not authorized to access.

Affected Systems

The vulnerability affects Red Hat Satellite 6 and its newer releases, including Satellite 6.16 for RHEL 8, Satellite 6.16–6.19 for RHEL 9, and associated capsule, maintenance, and utilities components. All installations that incorporate the Foreman component without the latest updates are susceptible.

Risk and Exploitability

The CVSS score of 4.3 classifies the flaw as moderate, and the EPSS score of < 1 % indicates a very low probability of exploitation. It is not listed in CISA’s KEV catalog. The attack requires an authenticated user with host‑edit permissions to send requests that contain nested organization and location identifiers that the system accepts even when the user is not authorized to access those resources.

Generated by OpenCVE AI on July 21, 2026 at 14:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Red Hat Satellite 6 update that includes the fix for the taxonomy_scope validation issue.
  • If an update cannot be applied immediately, enforce strict role‑based access control to ensure users with host‑edit permissions cannot reference organization or location identifiers outside their allowed scope.
  • Configure the application to validate organization and location IDs per the CWE‑639 mitigation techniques, rejecting any requests that target resources outside the user’s authorized scope.

Generated by OpenCVE AI on July 21, 2026 at 14:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite:6.19::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_capsule:6.19::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.19::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_utils:6.19::el9
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 01 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat satellite Capsule
Redhat satellite Maintenance
Redhat satellite Utils
CPEs cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite_maintenance:6.16::el8
cpe:/a:redhat:satellite_maintenance:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_utils:6.18::el9
Vendors & Products Redhat satellite Capsule
Redhat satellite Maintenance
Redhat satellite Utils
References

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Title Foreman: foreman: information disclosure via improper validation of nested request parameters
First Time appeared Redhat
Redhat satellite
Weaknesses CWE-639
CPEs cpe:/a:redhat:satellite:6
Vendors & Products Redhat
Redhat satellite
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Redhat Satellite Satellite Capsule Satellite Maintenance Satellite Utils
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-01T23:53:14.772Z

Reserved: 2026-03-30T10:53:25.776Z

Link: CVE-2026-5138

cve-icon Vulnrichment

Updated: 2026-07-01T14:39:46.200Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-01T12:29:33Z

Links: CVE-2026-5138 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:30:08Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key