The Foreman vulnerabilities
Published CVEs affecting The Foreman products: 2 record(s), with severity, exploitation and fixes.
CVE-2025-9572
Medium · 6.5
CWE-863 Feb 27, 2026
Foreman: satellite: graphql api permission bypass leads to information disclosure
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
CVE-2025-10622
High · 8.0
CWE-78 Nov 5, 2025
Foreman: os command injection via ct_location and fcct_location parameters
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.