Threats tagged 'ghsa-78fg-hppp-v99r'

A vulnerability in Foreman allows an authenticated user with view_hosts privileges to retrieve rendered provisioning template content for a host via the hosts template API endpoint. This can disclose sensitive data such as the host root password. The issue is an incomplete fix of CVE-2026-96659, which addressed the web UI preview path but left the API host-template render path accessible to Viewer-level users.