CVE-2026-5135: Foreman: foreman: unauthorized modification of host configurations via broken access control
A broken access control flaw was found in Foreman. This flaw allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host by modifying the match field via nested host attributes, bypassing authorization checks. The injected values are served by the ENC/classification pipeline to configuration management tools, potentially resulting in unauthorized modification of managed host configurations across organization and location boundaries.
Authenticated Foreman account with edit rights on at least one host (edithosts permission). The attacker needs two requests: first to create a legitimate override on their own host, then to retarget its match field to the victim host's FQDN. A lookup key with fqdn in its path must exist.
Other sources
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5135 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5136 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5138 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.19.1Patch CVE-2026-5142 - Compensating control
Ensure only appropriately authorized users can edit hosts/host configuration lookups across organizational and location boundaries; the attacker requires an authenticated Foreman account with edit rights on at least one host (edit_hosts permission) and can retarget a lookup override by modifying the match field via nested host attributes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5135?
The severity of CVE-2026-5135 is classified as medium with a score of 6.5.
How do I fix CVE-2026-5135?
To fix CVE-2026-5135, ensure that access control measures are updated to restrict host-edit permissions and validate modifications to nested host attributes.
What type of application is affected by CVE-2026-5135?
CVE-2026-5135 affects the Red Hat Foreman application.
What can an attacker exploit in CVE-2026-5135?
An attacker can exploit CVE-2026-5135 by using broken access controls to modify host configurations without proper authorization.
What are the potential impacts of CVE-2026-5135?
The potential impacts of CVE-2026-5135 include unauthorized modifications to host configurations and the injection of harmful values into system settings.