Description
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | candlepin +1 | 4.7.5-1.el9sat | RHSA-2026:34365 |
| Red Hat Satellite 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-5.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
Advisories 5
- WID-SEC-2026-2166 Red Hat Satellite (foreman, python-pillow, go): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:34366 Red Hat Security Advisory: Satellite 6.17.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34368 Red Hat Security Advisory: Satellite 6.18.7 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34365 Red Hat Security Advisory: Satellite 6.19.2 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34367 Red Hat Security Advisory: Satellite 6.16.10 Async Update Red Hat Security Advisories (RHSA) · Jul 2, 2026
References
- RHSA-2026:34365 vendor-advisory
- RHSA-2026:34366 vendor-advisory
- RHSA-2026:34367 vendor-advisory
- RHSA-2026:34368 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-5138 vdb-entry
- RHBZ#2452971 issue-tracking