CVE-2026-5138 Foreman: foreman: information disclosure via improper validation of nested request parameters

Medium 4.3 Published 1 Jul 2026 Updated 1 Jul 2026

Authenticated users with host-edit permissions can bypass authorization checks to leak sensitive infrastructure metadata from unauthorized organizations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-5138?

CVE-2026-5138 is a medium-severity missing authorization vulnerability in Redhat Satellite, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.

Weakness: CWE-639

Which versions are affected by CVE-2026-5138?

It affects 2 products.

Products include Redhat Satellite, Theforeman Foreman.

How do I fix CVE-2026-5138?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-5138 being exploited?

There is no known exploitation of CVE-2026-5138 in the wild and no public exploit code.

All Redhat Satellite vulnerabilities

Sources

Also known as GHSA-47r2-h2mh-qqjp.