Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-96659— Foreman: excessive permissions for viewer role on preview

Quick assessment

Affected

Red Hat Red Hat Satellite 6.16 for RHEL 8

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Foreman 中发现了一个安全漏洞。该漏洞允许拥有低级别 Viewer（查看者）权限的已认证用户，通过向模板预览端点提交请求，导致未经授权的敏感信息泄露。利用此漏洞，攻击者可以访问诸如主机 root 密码等敏感数据。此外，在系统配置不安全且 Safemode（安全模式）保护被禁用的情况下，该漏洞还可能允许攻击者以 Foreman 系统账户身份执行任意命令。

CVSS 9.1 · Critical EPSS 0.32% · P23 Updated Oct 03, 2026

Possible ATT&CK Techniques 3 AI

T1059.004 · Unix Shell T1082 · System Information Discovery T1078.002 · Domain Accounts

Affected Version Matrix 15

Vendor	Product	Version Range	Status
Red Hat	Red Hat Satellite 6.16 for RHEL 8	`0:3.12.0.23-1.el8sat< *`	unaffected
Red Hat	Red Hat Satellite 6.16 for RHEL 9	`0:3.12.0.23-1.el9sat< *`	unaffected
Red Hat	Red Hat Satellite 6.17 for RHEL 9	`0:3.14.0.22-1.el9sat< *`	unaffected
		`0:3.2.13-1.el9pc< *`	unaffected
		`0:3.1.62-1.el9pc< *`	unaffected
		`0:5.3.1-2.el9pc< *`	unaffected
		`0:0.6.0-1.el9pc< *`	unaffected
		`0:15.0.2-2.el9sat< *`	unaffected
		`0:3.14.0-2.el9sat< *`	unaffected
		`0:4.16.0.20-1.el9sat< *`	unaffected
… +3 more rows
Red Hat	Red Hat Satellite 6.18 for RHEL 9	`0:3.16.0.25-1.el9sat< *`	unaffected
Red Hat	Red Hat Satellite 6.19 for RHEL 9	`0:3.18.0.14-1.el9sat< *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Foreman: excessive permissions for viewer role on preview

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

特权定义了不安全动作

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Satellite 6.16 for RHEL 8	0:3.12.0.23-1.el8sat ~ *	`cpe:/a:redhat:satellite:6.16::el8`
Red Hat	Red Hat Satellite 6.16 for RHEL 9	0:3.12.0.23-1.el9sat ~ *	`cpe:/a:redhat:satellite:6.16::el8`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:3.14.0.22-1.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:3.2.13-1.el9pc ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:3.1.62-1.el9pc ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:5.3.1-2.el9pc ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:0.6.0-1.el9pc ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:15.0.2-2.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:3.14.0-2.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:4.16.0.20-1.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:1.5.0-2.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:6.17.12-1.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.17 for RHEL 9	0:0.1.0-2.1.el9sat ~ *	`cpe:/a:redhat:satellite:6.17::el9`
Red Hat	Red Hat Satellite 6.18 for RHEL 9	0:3.16.0.25-1.el9sat ~ *	`cpe:/a:redhat:satellite:6.18::el9`
Red Hat	Red Hat Satellite 6.19 for RHEL 9	0:3.18.0.14-1.el9sat ~ *	`cpe:/a:redhat:satellite:6.19::el9`

II. Public POCs for CVE-2026-96659

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-96659

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-96659 (6)

🔗 CVE-2026-96659 - Red Hat Customer Portal vdb-entry x_refsource_REDHAT
🔗 2536844 – (CVE-2026-96659) CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview Read full article issue-tracking x_refsource_REDHAT
🔗 RHSA-2026:74504 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:74503 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:74506 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:74505 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-96659

Same Patch Batch · Red Hat · 2026-10-01 · 18 CVEs total

CVE-2026-96658	9.9 CRITICAL	Foreman: safemode bypass leading to rce
CVE-2026-86345	9.0 CRITICAL	389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to f
CVE-2026-12405	8.8 HIGH	Rubygem-foreman_remote_execution: command injection in job invocations via effective_user
CVE-2026-12540	8.2 HIGH	Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
CVE-2026-12541	8.2 HIGH	Foreman: command injection in foreman-rake database tasks
CVE-2026-12544	7.7 HIGH	Foreman: ssti and insecure deserialization in foreman-rake configuration
CVE-2026-86344	7.5 HIGH	389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-oper
CVE-2026-12423	7.5 HIGH	Foreman: unauthenticated information disclosure via provisioning token validation flaw
CVE-2026-96577	7.1 HIGH	Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without a
CVE-2026-12545	6.7 MEDIUM	Rubygem-hammer_cli: command injection via insecure editor invocation
CVE-2026-56097	6.5 MEDIUM	Rubygem-katello: sql injection in registry proxy via labels
CVE-2026-103884	6.5 MEDIUM	Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allow
CVE-2026-83589	6.1 MEDIUM	Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
CVE-2026-103754	5.9 MEDIUM	Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows
CVE-2026-103641	5.5 MEDIUM	Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder
CVE-2026-12542	5.3 MEDIUM	Foreman: command injection in foreman-tail
CVE-2026-56098	4.3 MEDIUM	Rubygem-katello: improper authorization logic allows resource enumeration

IV. Related Vulnerabilities

Same product: Red Hat Satellite 6.16 for RHEL 8

Same vendor: Red Hat

Same weakness: CWE-267

V. Comments for CVE-2026-96659

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-96659— Foreman: excessive permissions for viewer role on preview

Quick assessment

Possible ATT&CK Techniques 3 AI

Affected Version Matrix 15

I. Basic Information for CVE-2026-96659

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-96659

III. Intelligence Information for CVE-2026-96659

Vendor Advisories for CVE-2026-96659 (6)

Same Patch Batch · Red Hat · 2026-10-01 · 18 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-96659

Leave a comment