CVE-2026-5135: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Satellite 6.16 for RHEL 8
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
AI Analysis
Technical Summary
This vulnerability in Red Hat Satellite 6 arises from improper authorization checks in the Foreman component. An authenticated user who has host-edit permissions can manipulate the match field through nested host attributes to retarget lookup value overrides to hosts they should not control. This effectively bypasses access controls and allows unauthorized changes to managed host configurations. No official remediation or patch is currently confirmed in the vendor advisory. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.
Potential Impact
An attacker with legitimate host-edit permissions can modify configuration overrides on hosts outside their authorized scope, potentially affecting hosts across different organizational units or locations. This unauthorized modification can lead to integrity issues in managed host configurations, possibly disrupting management policies or causing misconfigurations.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5135 for current remediation guidance. Until a fix is available, restrict host-edit permissions to trusted users only and monitor for unusual configuration changes. Follow vendor updates closely for any official fixes or workarounds.
CVE-2026-5135: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Satellite 6.16 for RHEL 8
Description
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Red Hat Satellite 6 arises from improper authorization checks in the Foreman component. An authenticated user who has host-edit permissions can manipulate the match field through nested host attributes to retarget lookup value overrides to hosts they should not control. This effectively bypasses access controls and allows unauthorized changes to managed host configurations. No official remediation or patch is currently confirmed in the vendor advisory. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.
Potential Impact
An attacker with legitimate host-edit permissions can modify configuration overrides on hosts outside their authorized scope, potentially affecting hosts across different organizational units or locations. This unauthorized modification can lead to integrity issues in managed host configurations, possibly disrupting management policies or causing misconfigurations.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5135 for current remediation guidance. Until a fix is available, restrict host-edit permissions to trusted users only and monitor for unusual configuration changes. Follow vendor updates closely for any official fixes or workarounds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-03-30T10:42:55.307Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-5135","vendor":"Red Hat"}]
Threat ID: 6a45260a27e9c79719982a8b
Added to database: 07/01/2026, 14:36:58 UTC
Last enriched: 07/01/2026, 14:54:09 UTC
Last updated: 07/02/2026, 00:21:46 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.