CVE-2026-107203— Foreman: domain and subnet interface api skips host search filters
Quick assessment
Affected
Red Hat Red Hat Satellite 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Foreman 软件的 网络接口处理 模块中发现了授权不当漏洞。域和子网接口 API 仅检查调用者是否具备主机权限，但未对该权限施加搜索范围限制，因此请求会从该域或子网中的所有接口返回响应。 低权限的网络攻击者或用户必须已具备查看某些主机以及查看与其他主机共享的某个域或子网的权限。他们可以请求该域或子网的接口信息。响应中将包含他们无权查看的主机的接口记录。如果该攻击者或用户还被允许编辑某些主机，他们还可以针对这些接口中的某一个提交更改。随后，该接口记录将保存此项更改。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107203
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Foreman: domain and subnet interface api skips host search filters
Source: CVE Program / CVE List V5
Vulnerability Description
An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
II. Public POCs for CVE-2026-107203
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107203
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-107203 (2)
-
-
🔗 2547470 – (CVE-2026-107203) CVE-2026-107203 foreman: domain and subnet interface API skips host search filters Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-12 · 12 CVEs total
| CVE-2026-87744 | 9.1 CRITICAL | Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest |
| CVE-2026-108094 | 7.8 HIGH | Mutter: mutter: client-triggered use-after-free in wayland color-management icc image desc |
| CVE-2026-75888 | 7.7 HIGH | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch |
| CVE-2026-83535 | 7.4 HIGH | Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-ti |
| CVE-2026-109082 | 6.8 MEDIUM | Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for pub |
| CVE-2026-94451 | 6.5 MEDIUM | Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: informat |
| CVE-2026-107193 | 6.5 MEDIUM | Foreman: api filter lookup ignores a search-limited filter permission |
| CVE-2026-85471 | 6.4 MEDIUM | Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable |
| CVE-2026-109194 | 6.4 MEDIUM | Quay: build trigger uuid idor in quay api |
| CVE-2026-83536 | 5.3 MEDIUM | Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris) |
| CVE-2026-109195 | 3.1 LOW | Quay: repository auto-prune policy uuid idor in quay api |
IV. Related Vulnerabilities
Same product: Red Hat Satellite 6
-
CVE-2026-107193
Foreman: api filter lookup ignores a search-limited filter p -
CVE-2026-107151
Rubygem-smart_proxy_dynflow: task update and done callbacks -
CVE-2026-103870
Pulp-rpm: distribution tree publish creates directories from -
CVE-2026-106471
Candlepin: candlepin: broken object-level authorization via -
CVE-2026-92904
Rubygem-foreman_remote_execution: job output readable withou
Same vendor: Red Hat
-
CVE-2026-100236
Dpdk: dpdk: heap out-of-bounds read/write in gso header copy -
CVE-2026-86565
Dpdk: dpdk: guest can desynchronize virtqueue size from infl -
CVE-2026-86563
Dpdk: dpdk: double offset bug in vhost log mapping calculati -
CVE-2026-86562
Dpdk: dpdk: control-queue descriptor double-fetch overflows -
CVE-2026-86561
Dpdk: dpdk: missing memory size validation before mmap in vh
Same weakness: CWE-863
-
CVE-2026-89072
MOVEit Transfer Authorization Flaw in Certificate Management -
CVE-2026-73126
Gitea private workflow badge token scope bypass -
CVE-2026-71184
Gitea fork workflow approval bypass through review events -
CVE-2026-70406
Gitea private comparison disclosure with public-only tokens -
CVE-2026-70400
Gitea private migration creation with public-only tokens
V. Comments for CVE-2026-107203
No comments yet