CVE-2026-5138: Foreman: foreman: information disclosure via improper validation of nested request parameters
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Other sources
Summary: A cross-tenant information disclosure flaw was found in Foreman. The taxonomyscope controller method does not validate organization and location IDs from nested request parameters against the current user's taxonomy memberships, bypassing the existing settaxonomy authorization check. This flaw allows an authenticated user with host-edit permissions to leak infrastructure metadata such as subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs from organizations and locations they do not belong to.
Requirements to exploit: Authenticated Foreman account with createhosts or edithosts permission (or equivalent hostgroup permissions) in at least one organization. Attacker crafts a single HTTP request with a valid own-org ID at the top level and a foreign org ID in nested params.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5135 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5136 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5138 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 3.19.1Patch CVE-2026-5142
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5138?
The severity of CVE-2026-5138 is classified as medium with a score of 4.3.
What is CVE-2026-5138 about?
CVE-2026-5138 is an information disclosure vulnerability in Foreman due to improper validation of nested request parameters.
Who can exploit CVE-2026-5138?
An authenticated user with host-edit permissions can exploit CVE-2026-5138.
How do I fix CVE-2026-5138?
To fix CVE-2026-5138, ensure that the organization and location IDs from nested request parameters are properly validated in the taxonomy_scope controller method.
Which software is affected by CVE-2026-5138?
CVE-2026-5138 affects Red Hat Satellite and the Foreman Project's Foreman software.