CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
Low-privilege users can access sensitive host passwords via template previews and potentially execute commands if Safemode is disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96659?
CVE-2026-96659 is a critical missing authorization vulnerability in Redhat Satellite, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Weakness: CWE-267
Which versions are affected by CVE-2026-96659?
It affects 2 products.
Products include Redhat Satellite, Theforeman Foreman.
How do I fix CVE-2026-96659?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-96659 being exploited?
There is no known exploitation of CVE-2026-96659 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
- CVE-2026-96658 Foreman: foreman: arbitrary code execution via safemode sandbox bypass
Sources
Also known as GHSA-2fj2-wwpq-f5jr.