Description
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | candlepin +1 | 4.7.5-1.el9sat | RHSA-2026:34365 |
| Red Hat Satellite 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-5.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
Advisories 5
- WID-SEC-2026-2166 Red Hat Satellite (foreman, python-pillow, go): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:34366 Red Hat Security Advisory: Satellite 6.17.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34368 Red Hat Security Advisory: Satellite 6.18.7 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34365 Red Hat Security Advisory: Satellite 6.19.2 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34367 Red Hat Security Advisory: Satellite 6.16.10 Async Update Red Hat Security Advisories (RHSA) · Jul 2, 2026
References
- RHSA-2026:34365 vendor-advisory
- RHSA-2026:34366 vendor-advisory
- RHSA-2026:34367 vendor-advisory
- RHSA-2026:34368 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-5135 vdb-entry
- RHBZ#2452230 issue-tracking