CVE-2026-9073
published 2026-06-23CVE-2026-9073: A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One…
PriorityP433medium6.2CVSS 3.1
AVLACLPRNUINSUCHINAN
EPSS
0.15%
4.9th percentile
A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
| satellite | foreman-mcp-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Satellite 6 log file
vuldb·2026-06-23·CVSS 6.2
CVE-2026-9073 [MEDIUM] Red Hat Satellite 6 log file
A vulnerability has been found in Red Hat Satellite 6 and classified as problematic. Affected by this issue is some unknown functionality. This manipulation causes sensitive information in log files.
This vulnerability appears as CVE-2026-9073. The attack requires local access. There is no available exploit.
GHSA
A flaw was found in foreman-mcp-server.
ghsa_unreviewed·2026-06-23
CVE-2026-9073 [MEDIUM] CWE-532 A flaw was found in foreman-mcp-server.
A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.
Red Hat
foreman-mcp-server: MCP Server: Insecure Sensitive HTTP Header Sanitization
vendor_redhat·2026-06-23·CVSS 6.2
CVE-2026-9073 [MEDIUM] CWE-532 foreman-mcp-server: MCP Server: Insecure Sensitive HTTP Header Sanitization
foreman-mcp-server: MCP Server: Insecure Sensitive HTTP Header Sanitization
A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.
Statement: This Moderate impact flaw in `foreman-mcp
No detection rules found.
No public exploits indexed.
2026-06-23
Published