CVE-2026-96659 is a critical security flaw in Foreman where an authenticated user with minimal Viewer permissions can access sensitive information by interacting with template preview endpoints. The vulnerability permits unauthorized disclosure of sensitive data including host root passwords. Moreover, in insecure configurations where Safemode protections are disabled, the vulnerability can be leveraged to execute arbitrary commands with the privileges of the Foreman system account. Red Hat has issued a security advisory (RHSA-2026:74503) providing patches for Red Hat Satellite 6.19 on RHEL 9 to remediate this and related vulnerabilities.

The vulnerability enables unauthorized information disclosure of sensitive data such as host root passwords to low-privileged authenticated users. Under insecure configurations without Safemode protections, it can escalate to arbitrary command execution as the Foreman system account, potentially leading to full system compromise. The CVSS v3.1 score is 9.1 (critical), reflecting high confidentiality, integrity, and availability impacts.

A security update fixing this vulnerability is available from Red Hat as part of Red Hat Satellite 6.19 for RHEL 9 (see RHSA-2026:74503). Users should apply this official patch promptly. The vendor advisory does not indicate that the issue is already mitigated or requires no action. Follow Red Hat's update instructions to ensure the vulnerability is remediated.