Vulnerabilidades do The Foreman Foreman
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam The Foreman Foreman: 2 registro(s), com versões afetadas e correções.
CVE-2025-9572
Média · 6.5
CWE-863 27/02/2026
Foreman: satellite: graphql api permission bypass leads to information disclosure
n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.
CVE-2025-10622
Alta · 8.0
CWE-78 05/11/2025
Foreman: os command injection via ct_location and fcct_location parameters
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.