CVE-2026-13316

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.

In Foreman before 6.2, when the SSH service is enabled on discovered nodes, discovery-debug displays the root password in plaintext in the system journal during login.

Foreman versions from 1.1 to before 1.9.0-RC1 do not redirect HTTP requests to HTTPS when the require_ssl setting is enabled. This allows remote attackers to obtain user credentials via a man-in-the-middle attack.

Foreman since version 1.5 is vulnerable to an incorrect authorization check, allowing users with user management permissions assigned to certain organizations to perform all operations granted by these permissions on administrator user objects outside their scope.

The Organization and Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions, enabling (a) reading, (b) editing, or (c) deleting arbitrary organizations or locations.

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.

Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.

Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in search.rb or puppetclass.rb, related to the search mechanism.

A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.

A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) by bypassing the Safemode sandbox within the templating engine. Due to improper handling of delegated methods, the attacker can append unauthorized functions to the allowed execution list, enabling arbitrary command execution on the hosting server.