CVE-2026-5138
published 2026-07-01CVE-2026-5138: A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.23%
13.9th percentile
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | >= 6.16 < 6.16.10 | 6.16.10 |
| redhat | satellite | >= 6.17 < 6.17.9 | 6.17.9 |
| redhat | satellite | >= 6.18 < 6.18.7 | 6.18.7 |
| redhat | satellite | >= 6.19 < 6.19.2 | 6.19.2 |
| satellite-capsule_el8 | foreman | — | — |
| theforeman | foreman | < 3.18.2 | 3.18.2 |
| theforeman | foreman | >= 3.19.0 < 3.19.1 | 3.19.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
foreman: Foreman: Information disclosure via improper validation of nested request parameters
vendor_redhat·2026-07-01·CVSS 4.3
CVE-2026-5138 [MEDIUM] CWE-639 foreman: Foreman: Information disclosure via improper validation of nested request parameters
foreman: Foreman: Information disclosure via improper validation of nested request parameters
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Package: satellite-capsule:el8/foreman (Red Hat Satellite 6) - Affected
GHSA
A flaw was found in Foreman.
ghsa_unreviewed·2026-07-01
CVE-2026-5138 [MEDIUM] CWE-639 A flaw was found in Foreman.
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
No detection rules found.
No public exploits indexed.
2026-07-01
Published