CVE-2026-5138
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A flaw was found in Foreman that allows cross-tenant information disclosure. An authenticated user with host-edit permissions can bypass authorization checks and leak sensitive infrastructure metadata from other organizations.
Risk Assessment
The organization risks exposure of sensitive infrastructure metadata including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, which could facilitate network attacks.
Recommendation
Immediately update Foreman to a patched version and review user permissions for host-edit access.
Other vulnerabilities in Foreman
See all- CVE-2015-5246High
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
- CVE-2016-4996High
In Foreman before 6.2, when the SSH service is enabled on discovered nodes, discovery-debug displays the root password in plaintext in the system journal during login.
- CVE-2015-5152High
Foreman versions from 1.1 to before 1.9.0-RC1 do not redirect HTTP requests to HTTPS when the require_ssl setting is enabled. This allows remote attackers to obtain user credentials via a man-in-the-middle attack.
- CVE-2017-7505High
Foreman since version 1.5 is vulnerable to an incorrect authorization check, allowing users with user management permissions assigned to certain organizations to perform all operations granted by these permissions on administrator user objects outside their scope.
- CVE-2016-4475High
The Organization and Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions, enabling (a) reading, (b) editing, or (c) deleting arbitrary organizations or locations.
- CVE-2013-0210High
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
- CVE-2013-0171High
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
- CVE-2012-5648High
Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in search.rb or puppetclass.rb, related to the search mechanism.
- CVE-2026-81658Medium
Foreman template revision endpoint lacks object-level authorization. A low-privileged user can retrieve historical template contents from another organization or location.
- CVE-2026-5142Medium
A flaw was found in Foreman that allows authenticated users with 'view_keypairs' permission to download private SSH keys from other organizations by directly querying key pair IDs. This vulnerability bypasses taxonomy scoping, leading to cross-tenant data exposure in multi-tenant deployments.
Original NVD description (English source)
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.