Filtered by vendor Theforeman
Subscribe
Total
98 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-12112 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-07-16 | N/A | 7.8 HIGH |
| A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution. | |||||
| CVE-2026-9073 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-07-15 | N/A | 6.2 MEDIUM |
| A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform. | |||||
| CVE-2026-5136 | 2 Redhat, Theforeman | 3 Enterprise Linux, Satellite, Foreman | 2026-07-09 | N/A | 8.8 HIGH |
| A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access. | |||||
| CVE-2026-5135 | 2 Redhat, Theforeman | 3 Enterprise Linux, Satellite, Foreman | 2026-07-09 | N/A | 6.5 MEDIUM |
| A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries. | |||||
| CVE-2026-5138 | 2 Redhat, Theforeman | 3 Enterprise Linux, Satellite, Foreman | 2026-07-09 | N/A | 4.3 MEDIUM |
| A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access. | |||||
| CVE-2026-5142 | 2 Redhat, Theforeman | 3 Enterprise Linux, Satellite, Foreman | 2026-07-09 | N/A | 6.5 MEDIUM |
| A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information. | |||||
| CVE-2026-13316 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-07-06 | N/A | 4.4 MEDIUM |
| A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component. | |||||
| CVE-2025-9572 | 2 Redhat, Theforeman | 4 Enterprise Linux, Satellite, Satellite Capsule and 1 more | 2026-06-17 | N/A | 5.0 MEDIUM |
| n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass. | |||||
| CVE-2024-7700 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-06-17 | N/A | 6.5 MEDIUM |
| A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script. | |||||
| CVE-2023-4886 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-06-17 | N/A | 6.7 MEDIUM |
| A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable. | |||||
| CVE-2023-0462 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-06-17 | N/A | 8.0 HIGH |
| An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload. | |||||
| CVE-2023-0118 | 2 Redhat, Theforeman | 3 Enterprise Linux, Satellite, Foreman | 2026-06-17 | N/A | 9.1 CRITICAL |
| An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system. | |||||
| CVE-2022-3874 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-06-17 | N/A | 8.0 HIGH |
| A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system. | |||||
| CVE-2021-3590 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-06-17 | N/A | 8.8 HIGH |
| A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | |||||
| CVE-2021-3589 | 2 Redhat, Theforeman | 2 Satellite, Foreman Ansible | 2026-06-17 | 6.5 MEDIUM | 8.0 HIGH |
| An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | |||||
| CVE-2021-3584 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2026-06-17 | 9.0 HIGH | 7.2 HIGH |
| A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0. | |||||
| CVE-2021-3494 | 1 Theforeman | 1 Foreman | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0. | |||||
| CVE-2021-3469 | 1 Theforeman | 1 Foreman | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly. | |||||
| CVE-2021-3457 | 1 Theforeman | 1 Smart Proxy Shell Hooks | 2026-06-17 | 3.6 LOW | 6.1 MEDIUM |
| An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability. | |||||
| CVE-2021-3456 | 1 Theforeman | 1 Smart Proxy Salt | 2026-06-17 | 3.6 LOW | 7.1 HIGH |
| An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability. | |||||