Act nowDisclosed

Advisory · CVE-2026-96659

Foreman's viewer role could peek at host root passwords

An authenticated Foreman user with low-level Viewer permissions could abuse template preview endpoints to disclose sensitive host data, including root passwords, and potentially run commands as the Foreman service account.

Advisory published October 1, 2026Independent summary
Vendor
Red Hat
Product
Foreman
Identifier / CWE
CVE-2026-96659
CWE-267
Action timing
Immediate
ELI5

Explain it like I’m five

Foreman gave the kid with the visitor badge a key to the manager's office. Anyone allowed to peek at templates could peek at secret passwords too, and on some setups they could even run commands as the boss.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Viewer signs in

    An authenticated user holding only low-level Viewer permissions accesses Foreman normally.

  2. 02Template preview called

    The user submits crafted requests to the template preview endpoints, which fail to enforce the Viewer's restricted role.

  3. 03Secrets disclosed

    The endpoints return sensitive host attributes such as root passwords that should be restricted to higher-privileged administrators.

  4. 04Safemode gap

    Where template Safemode protections are disabled or circumvented, the same authorization flaw can escalate to arbitrary command execution as the Foreman service account.

What happened

Red Hat published a fix for CVE-2026-96659, rated critical at CVSS 9.1, as part of the Satellite 6.19.5 async update. The flaw is in Foreman’s template preview endpoints: they did not enforce the restricted permissions of the Viewer role. An authenticated user with only Viewer privileges could submit requests to those endpoints and read sensitive host attributes, including host root passwords.

Red Hat notes that where template Safemode protections are disabled or can be circumvented, this authorization failure can escalate further, allowing arbitrary command execution under the identity of the Foreman service account.

What to do

  1. Update to Red Hat Satellite 6.19.5 (which ships the fixed foreman-3.18.0.14-1.el9sat package) following the RHSA-2026:74503 guidance.
  2. Review which accounts hold Viewer permissions and trim them to what each role genuinely needs.
  3. Confirm template Safemode protections are enabled and cannot be bypassed in your environment.
  4. Audit template preview and rendering logs for unusual access patterns by low-privileged accounts.
  5. Rotate host root passwords and other credentials that may have been exposed through the preview endpoints.

Management note

This is a classic least-privilege failure in a tool that manages your entire fleet: the lowest role on the ladder could reach the most sensitive secrets in the building. Patching closes the hole, but the permission review matters just as much, because Satellite holds the keys to every host it manages.