CVE-2026-96659
CriticalCVSS 9.1Summary
A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.
Risk Assessment
This vulnerability enables low-privilege users to access critical credential data and potentially execute commands, leading to full compromise of managed hosts. The risk is critical in environments with Safemode disabled or broadly granted Viewer permissions.
Recommendation
Upgrade Foreman to the vendor-patched version. Also enable Safemode, restrict Viewer permissions, and audit access to template preview endpoints.
Other vulnerabilities in Foreman
See all- CVE-2026-12544High
A flaw was found in Foreman's foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, where configuration data is processed through two distinct executable layers. This enables Server-Side Template Injection (SSTI) and insecure deserialization, potentially leading to remote code execution.
- CVE-2026-12541High
OS command injection vulnerabilities exist in Foreman's foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call.
- CVE-2026-12540High
A command injection vulnerability exists in Foreman's foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.
- CVE-2026-12423High
The Red Hat Satellite /unattended/provision API endpoint in Foreman is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.
- CVE-2015-5246High
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
- CVE-2016-4996High
In Foreman before 6.2, when the SSH service is enabled on discovered nodes, discovery-debug displays the root password in plaintext in the system journal during login.
- CVE-2015-5152High
Foreman versions from 1.1 to before 1.9.0-RC1 do not redirect HTTP requests to HTTPS when the require_ssl setting is enabled. This allows remote attackers to obtain user credentials via a man-in-the-middle attack.
- CVE-2017-7505High
Foreman since version 1.5 is vulnerable to an incorrect authorization check, allowing users with user management permissions assigned to certain organizations to perform all operations granted by these permissions on administrator user objects outside their scope.
- CVE-2016-4475High
The Organization and Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions, enabling (a) reading, (b) editing, or (c) deleting arbitrary organizations or locations.
- CVE-2013-0210High
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
Original NVD description (English source)
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS