CVE-2026-86324Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller

Beschreibung

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• RHSA-2026:100120 vendor-advisory
• RHSA-2026:99949 vendor-advisory
• RHSA-2026:99950 vendor-advisory
• RHSA-2026:99952 vendor-advisory
• https://access.redhat.com/security/cve/CVE-2026-86324 vdb-entry
• RHBZ#2529291 issue-tracking