Red Hat Satellite (Foreman): Information disclosure via template preview endpoints
Summary
A flaw in Foreman, which Red Hat Satellite is built on, allows an authenticated user with only the Viewer role to submit requests to template preview endpoints. This can expose sensitive host data, such as host root passwords. If Safemode is disabled or bypassed, the user may also execute arbitrary commands as the Foreman system account.
Affected
- Red Hat Satellite 6.16 (RHEL 8 and 9), 6.17 (RHEL 9), 6.18 (RHEL 9) and 6.19 (RHEL 9) as listed in Red Hat's CVE record; exact fixed versions for 6.17 and older streams are unconfirmed
- Upstream Foreman 1.9.0 through 3.19.1 and 5.0.0 (according to theforeman.org)
Fixed in
- Upstream Foreman 3.19.2 and 5.0.1
- Satellite 6.19: RHSA-2026:74503
- Satellite 6.18: RHSA-2026:74504 (package foreman-0:3.16.0.25-1.el9sat)
- Satellite 6.17: RHSA-2026:74505 (fixed version unconfirmed)
- Satellite 6.16: RHSA-2026:74506 (package foreman-3.12.0.23-1.el8sat.noarch.rpm)
- Satellite 6.15 and older: Unknown.
Workaround
- No vendor-documented workaround is available; apply the Satellite update.
- Keep Foreman Safemode enabled (the default). This limits the code-execution risk but does not prevent the information disclosure.
- Review and remove unneeded accounts with Viewer or read roles.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Not listed in the CISA KEV catalog. No public proof of concept found.
Our recommendation
- Check whether Foreman or Red Hat Satellite is in use in your environment, including exposure to the internet.
- Apply the fixed release for your Satellite stream as soon as possible, together with the related Safemode bypass fix for CVE-2026-96658.
- Confirm that Foreman Safemode is enabled.
- Review accounts with Viewer or read roles and remove those that are not needed.
- Monitor access to template preview endpoints and host data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Security Advisory RHSA-2026:74503 access.redhat.com
- Red Hat Security Advisory RHSA-2026:74504 access.redhat.com
- Red Hat Security Advisory RHSA-2026:74505 access.redhat.com
- Red Hat Security Advisory RHSA-2026:74506 access.redhat.com
- Red Hat CVE page CVE-2026-96659 access.redhat.com
- Red Hat Bugzilla 2536844 bugzilla.redhat.com
- Foreman security advisories theforeman.org
- Foreman 3.19.2 release announcement community.theforeman.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:45.
Original description (NVD)
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
NVD references (7)
- https://access.redhat.com/errata/RHSA-2026:74503
- https://access.redhat.com/errata/RHSA-2026:74504
- https://access.redhat.com/errata/RHSA-2026:74505
- https://access.redhat.com/errata/RHSA-2026:74506
- https://access.redhat.com/security/cve/CVE-2026-96659
- https://bugzilla.redhat.com/show_bug.cgi?id=2536844
- http://www.openwall.com/lists/oss-security/2026/10/07/1
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.