Theforeman vulnerabilities, page 5
105 vulnerabilities
Known vulnerabilities in Theforeman products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.
HighCVE-2017-7505foreman +1 moreforeman foremanForeman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.EPSS1.59%MediumCVE-2017-7535foreman +1 moreforeman foremanforeman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.EPSS1.49%MediumCVE-2017-15100foreman project · foreman +3 moreforeman project foremanAn attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.EPSS1.10%MediumCVE-2024-7700theforeman · foremanForeman: command injection in "host init config" template via "install packages" field on foremanA command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.EPSS0.78%MediumCVE-2019-14825RubyGems · katello +2 moreRubyGems katelloA cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.EPSS0.65%MediumCVE-2019-10198redhat · satellite +2 moreredhat satelliteAn authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.EPSS1.60%MediumCVE-2019-3893redhat · satellite +2 moreredhat satelliteIn Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.EPSS1.83%MediumCVE-2026-13316ubuntu · ruby-foreman +2 moreForeman: ssrf to cloud metada service through unvalidated test_url parameters in foreman configA flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component.EPSS0.15%HighCVE-2026-1961redhat · satellite +1 moreForman: foreman: remote code execution via command injection in websocket proxyA flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.EPSS1.89%MediumCVE-2026-9073PyPI · foreman-mcp-server +2 moreForeman-mcp-server: mcp server: insecure sensitive http header sanitizationA flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.EPSS0.21%MediumCVE-2026-5135redhat · satellite +1 moreForeman: foreman: unauthorized modification of host configurations via broken access controlA flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.EPSS0.43%MediumCVE-2026-5138redhat · satellite +1 moreForeman: foreman: information disclosure via improper validation of nested request parametersA flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.EPSS0.38%MediumCVE-2026-5142redhat · satellite +1 moreForeman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypassA flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.EPSS0.45%HighCVE-2026-5136redhat · satellite +1 moreForeman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulationA flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.EPSS0.56%MediumCVE-2026-81658redhat · satellite +1 moreForeman: cross-tenant disclosure of template revisions via unauthorized audit lookupA flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.EPSS0.34%HighCVE-2026-96658redhat · satellite +1 moreForeman: foreman: arbitrary code execution via safemode sandbox bypassA flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.EPSS0.69%CriticalCVE-2026-96659redhat · satellite +1 moreForeman: excessive permissions for viewer role on previewA flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.EPSS0.32%HighCVE-2026-12112redhat · satellite +1 moreForeman-mcp-server: mcp server: active session hijacking via insecure session state reuseA flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.EPSS0.22%HighCVE-2026-12544redhat · satellite +1 moreForeman: ssti and insecure deserialization in foreman-rake configurationA flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.EPSS0.21%HighCVE-2026-12542redhat · satellite +1 moreForeman: command injection in foreman-tailA flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.EPSS0.56%