CVE-2026-96659: Foreman: excessive Viewer role permissions on template preview
CVE-2026-96659 is a critical flaw in Foreman, rated CVSS score 9.1 by the CNA, in which a user with low-level Viewer permissions can reach template preview endpoints and obtain sensitive information such as host root passwords. The record states that where Safemode protections are disabled, the flaw may also allow execution of arbitrary commands as the Foreman system account. No confirmed exploitation appears in the sources consulted.
Overview
According to the record, a flaw in Foreman lets an authenticated user with Viewer permissions submit requests to template preview endpoints and obtain information that the role should not expose. The CNA rates it critical with a CVSS score of 9.1.
Impact
- Unauthorized information disclosure, which the record says can include sensitive data such as host root passwords.
- Where Safemode protections are disabled, the record says the flaw may allow execution of arbitrary commands as the Foreman system account.
- The CVSS vector indicates network reachability, low privileges required, no user interaction, a scope change, and high confidentiality impact.
Affected products and versions
- Theforeman Foreman: from 1.9.0 up to and including 3.19.1, and version 5.0.0, as listed in the record.
- Red Hat Satellite: the record lists ranges from 6.16 before 6.16.4, from 6.17 before 6.17.12, from 6.18 before 6.18.10, and from 6.19 before 6.19.5.
- Several Red Hat Satellite product entries for different RHEL releases are listed without specified versions.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- No confirmed exploitation appears in the sources consulted.
- The SSVC record shows exploitation as none and automatable as no.
- The EPSS probability is 0.00324 with a percentile of 0.24239.
Remediation and mitigation
- Apply the Red Hat Satellite errata referenced in the record, such as RHSA-2026:74506, and the related advisories listed.
- For Foreman, the record links an upstream patch on the oss-security mailing list, but it does not state a specific fixed release.
- Review which accounts hold the Viewer role and restrict access to template preview functions until patches are applied.
- Confirm that Safemode protections are enabled, since the record ties the command execution risk to their absence.
Detection guidance
- Review web and application logs for unusual requests to template preview endpoints from low-privilege accounts.
- Monitor for unexpected activity associated with the Foreman service account.
- Audit recent role assignments and permission changes affecting the Viewer role.
Limitations of the available information
- The record does not provide a fixed Foreman version.
- The CWE name is not given; only the identifier CWE-267 is present.
- Per-version details for each Satellite product entry are not specified in the record.
- Full vendor advisory contents were not reviewed for this analysis.
Frequently asked questions
What does CVE-2026-96659 allow?
According to the record, an authenticated user with Viewer permissions can submit requests to template preview endpoints and access sensitive data, such as host root passwords.
Is this CVE known to be exploited in the wild?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Apply the vendor errata for affected Red Hat Satellite releases, review accounts holding the Viewer role, and confirm that Safemode protections are enabled.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.