Description
A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite Capsule 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | candlepin +1 | 4.7.5-1.el9sat | RHSA-2026:34365 |
| Red Hat Satellite 6 | dynflow-utils | 1.6.3-1.1.el9sat | RHSA-2026:34366 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.17-1.el8sat | RHSA-2026:34368, RHSA-2026:34367, RHSA-2026:34366 |
| Red Hat Satellite 6 | python-pillow +2 | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-5.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
Advisories 5
- WID-SEC-2026-2166 Red Hat Satellite (foreman, python-pillow, go): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:34366 Red Hat Security Advisory: Satellite 6.17.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34368 Red Hat Security Advisory: Satellite 6.18.7 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34365 Red Hat Security Advisory: Satellite 6.19.2 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34367 Red Hat Security Advisory: Satellite 6.16.10 Async Update Red Hat Security Advisories (RHSA) · Jul 2, 2026
References
- RHSA-2026:34365 vendor-advisory
- RHSA-2026:34366 vendor-advisory
- RHSA-2026:34367 vendor-advisory
- RHSA-2026:34368 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-5142 vdb-entry
- RHBZ#2452999 issue-tracking