Description
A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | candlepin +1 | 4.7.5-1.el9sat | RHSA-2026:34365 |
| Red Hat Satellite 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-5.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
Advisories 5
- WID-SEC-2026-2166 Red Hat Satellite (foreman, python-pillow, go): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:34366 Red Hat Security Advisory: Satellite 6.17.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34368 Red Hat Security Advisory: Satellite 6.18.7 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34365 Red Hat Security Advisory: Satellite 6.19.2 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34367 Red Hat Security Advisory: Satellite 6.16.10 Async Update Red Hat Security Advisories (RHSA) · Jul 2, 2026
References
- RHSA-2026:34365 vendor-advisory
- RHSA-2026:34366 vendor-advisory
- RHSA-2026:34367 vendor-advisory
- RHSA-2026:34368 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-5136 vdb-entry
- RHBZ#2452970 issue-tracking