CVE-2026-92893

MediumCVSS 4.3

Published: 17/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.

Risk Assessment

An authenticated user can access hidden host configuration data, breaching confidentiality and potentially exposing sensitive information.

Recommendation

Update the foreman_ansible plugin to a patched version. If not available, restrict user permissions and monitor API access.

Other vulnerabilities in foreman_ansible plugin

CVE-2026-92894Medium
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS