Theforeman Foreman vulnerabilities

CVE-2013-0171 [HIGH] CWE-94 CVE-2013-0171: Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to th Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.

CVE-2018-1097 [HIGH] CWE-200 CVE-2018-1097: A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for power A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.

CVE-2016-9593 [HIGH] CWE-522 CVE-2016-9593: foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.

CVE-2012-5648 [HIGH] CWE-89 CVE-2012-5648: Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arb Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) app/models/hostext/search.rb or (2) app/models/puppetclass.rb, related to the search mechanism.

CVE-2013-4386 [HIGH] CWE-89 CVE-2013-4386: Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.

CVE-2025-9572 [MEDIUM] CWE-863 CVE-2025-9572: n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

CVE-2014-8183 [HIGH] CWE-284 CVE-2014-8183: It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce acc It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

CVE-2015-5152 [HIGH] CWE-200 CVE-2015-5152: Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.

CVE-2026-5142 [MEDIUM] CWE-639 CVE-2026-5142: A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive inform

CVE-2026-5135 [MEDIUM] CWE-639 CVE-2026-5135: A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user w A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for u

CVE-2018-1096 [MEDIUM] CWE-89 CVE-2018-1096: An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1 An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.

CVE-2014-4507 [MEDIUM] CWE-22 CVE-2014-4507: Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allo Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.

CVE-2013-0174 [MEDIUM] CWE-200 CVE-2013-0174: The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the h The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.

CVE-2013-0187 [MEDIUM] CWE-264 CVE-2013-0187: Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.

CVE-2021-3494 [MEDIUM] CWE-319 CVE-2021-3494: A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the f A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this fl

CVE-2016-8613 [MEDIUM] CWE-79 CVE-2016-8613: A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS v

CVE-2015-3235 [MEDIUM] CWE-264 CVE-2015-3235: Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit admini Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.

CVE-2016-5390 [MEDIUM] CWE-200 CVE-2016-5390: Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.

CVE-2016-4451 [MEDIUM] CWE-254 CVE-2016-4451: The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 al The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

CVE-2019-3893 [MEDIUM] CWE-732 CVE-2019-3893: In Foreman it was discovered that the delete compute resource operation, when executed from the Fore In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions b