CVE-2026-96659: redhat satellite Privilege Defined With Unsafe Actions

Vulnerability summary

CVE-2026-96659 is a critical (CVSS 9.1) Privilege Defined With Unsafe Actions vulnerability in redhat satellite. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.9% of scored vulnerabilities.

Timeline

1. 01-10-2026
   PublishedVulnerability first disclosed.
2. 16-10-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

• CWE-267Privilege Defined With Unsafe ActionsA particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.