CVE-2026-96659
published 2026-10-01CVE-2026-96659: A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by…
PriorityP357critical9.1CVSS 3.1
AVNACLPRLUINSCCHILAL
EPSS
0.32%
24.2th percentile
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | >= 6.16 < 6.16.4 | 6.16.4 |
| redhat | satellite | >= 6.17 < 6.17.12 | 6.17.12 |
| redhat | satellite | >= 6.18 < 6.18.10 | 6.18.10 |
| redhat | satellite | >= 6.19 < 6.19.5 | 6.19.5 |
| theforeman | foreman | — | — |
| theforeman | foreman | 1.9.0 – 3.19.1 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in Foreman.
ghsa_unreviewed·2026-10-01
CVE-2026-96659 [CRITICAL] CWE-267 A flaw was found in Foreman.
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Red Hat
foreman: Excessive Permissions for Viewer Role on Preview
vendor_redhat·2026-10-01·CVSS 9.1
CVE-2026-96659 [CRITICAL] CWE-267 foreman: Excessive Permissions for Viewer Role on Preview
foreman: Excessive Permissions for Viewer Role on Preview
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Statement: This vulnerability is rated as having an Important security impact because authenticated users assigned restricted Viewer permissions can bypass role-based access controls to retrieve sensitive host credentials. In Red Hat Satellite environments, q
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
blogs_hackernews·2026-10-05·CVSS 7.5
CVE-2026-88779 [HIGH] ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook.
There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others are still getting in because the basics gave way first.
Here’s what mattered this week.
## ⚡ Threat of the Week
Citrix Warns of Ne
Bugzilla
CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview
bugzilla·2026-09-17·CVSS 9.1
CVE-2026-96659 [CRITICAL] CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview
CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview
When accessing certain API endpoints (e.g. POSTing to /template/preview) a user with the Viewer role is able to access information they should not be able to (i.e. `@host.root_pass`). When the system is configured insecurely (i.e. Safemode is disabled), or a Safemode bypass vulnerability exists, then the Viewer is able to perform Remote Code Execution on the system as the foreman system account.
Discussion:
This issue has been addressed in the following products:
Red Hat Satellite 6.18 for RHEL 9
Via RHSA-2026:74504 https://access.redhat.com/errata/RHSA-2026:74504
---
This issue has been addressed in the following products:
Red Hat Satellite 6.17 for RHEL 9
Via RHSA-2026:74505 https://access.redhat.com/errata
https://access.redhat.com/errata/RHSA-2026:74503https://access.redhat.com/errata/RHSA-2026:74504https://access.redhat.com/errata/RHSA-2026:74505https://access.redhat.com/errata/RHSA-2026:74506https://access.redhat.com/security/cve/CVE-2026-96659https://bugzilla.redhat.com/show_bug.cgi?id=2536844http://www.openwall.com/lists/oss-security/2026/10/07/1
2026-10-01
Published