6.5Mittel
CVE-2026-5142Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass
Beschreibung
A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | all versions | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | all versions | |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | all versions | |
| redhat | satellite | 6.18 – < 6.18.7 | |
| satellite | 6.16 | — | |
| satellite | 6.17 | — | |
| satellite | 6.18 | — | |
| satellite | 6.19 | — | |
| satellite capsule | 6.16 | — | |
| satellite capsule | 6.17 | — | |
| satellite capsule | 6.18 | — | |
| satellite capsule | 6.19 | — | |
| satellite maintenance | 6.16 | — | |
| satellite maintenance | 6.17 | — | |
| satellite maintenance | 6.19 | — | |
| satellite utils | 6.16 | — | |
| satellite utils | 6.17 | — | |
| satellite utils | 6.18 | — | |
| satellite utils | 6.19 | — | |
| theforeman | foreman | < 3.18.2 |
Referenzen und Patches
- RHSA-2026:34365 vendor-advisoryVendor Advisory
- RHSA-2026:34366 vendor-advisoryVendor Advisory
- RHSA-2026:34367 vendor-advisoryVendor Advisory
- RHSA-2026:34368 vendor-advisoryVendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5142 vdb-entryVendor Advisory
- RHBZ#2452999 issue-trackingIssue TrackingVendor Advisory
CPE-Treffer (NVD) (6)
cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.18 < 6.18.7cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.16 < 6.16.10cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.17 < 6.17.9cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.2cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*< 3.18.2cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*≥ 3.19.0 < 3.19.1