6.5
Moyenne
CVE-2026-5142 A flaw was found in foreman
Description
A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Satellite 6 | Versions non publiées | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions non publiées | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions non publiées | |
| Red Hat Satellite 6.18 for RHEL 9 | Versions non publiées | |
| Red Hat Satellite 6.17 for RHEL 9 | Versions non publiées | |
| Red Hat Satellite 6.19 for RHEL 9 | Versions non publiées |
Références
- RHSA-2026:34365 access.redhat.com
- RHSA-2026:34366 access.redhat.com
- RHSA-2026:34367 access.redhat.com
- RHSA-2026:34368 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2452999 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Satellite 6
Les 195 CVE de Red Hat Satellite 6 →
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
Élevée
CVE-2026-93998
Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
7.4
Élevée
CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper
5.3
Moyenne
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne