Threats affecting pkg:rpm/redhat/foreman

A critical vulnerability (CVE-2026-96659) affects Foreman versions 6.19.0 through 6.19.4. It allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. This can expose sensitive data such as host root passwords. Furthermore, if Safemode protections are disabled, the vulnerability may enable arbitrary command execution as the Foreman system account. A security update is available that addresses this issue.

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.