CVE-2026-5142: Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Published Mar 30, 2026
·
Updated

A flaw was found in foreman. Authenticated users with 'viewkeypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.

Other sources

KeyPairsController#show bypasses taxonomy scoping, allowing authenticated users with viewkeypairs permission to download private SSH keys across organizations by directly querying key pair IDs. This results in cross-tenant data exposure in multi-tenant deployments.

Requirements to exploit:

Authenticated user account Permission viewkeypairs (e.g., via Viewer role) Ability to guess or enumerate KeyPair IDs (low complexity due to predictable IDs)

Red Hat

Affected Software

13 affected components
theforeman foreman
theforeman foreman>=3.18.1<=3.19.0
All of the following
redhat Satellite>=6.18<6.18.7
redhat Enterprise Linux=9.0
All of the following
redhat Satellite>=6.16<6.16.10
Any of the following
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
All of the following
redhat Satellite>=6.17<6.17.9
redhat Enterprise Linux=9.0
All of the following
redhat Satellite>=6.19<6.19.2
redhat Enterprise Linux=9.0
theforeman foreman<3.18.2
theforeman foreman>=3.19.0<3.19.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade foreman to a version that resolves this vulnerability.

    Fixed in 3.18.2Patch CVE-2026-5135
  2. Upgrade

    Upgrade foreman to a version that resolves this vulnerability.

    Fixed in 3.18.2Patch CVE-2026-5136
  3. Upgrade

    Upgrade foreman to a version that resolves this vulnerability.

    Fixed in 3.18.2Patch CVE-2026-5138
  4. Upgrade

    Upgrade foreman to a version that resolves this vulnerability.

    Fixed in 3.19.1Patch CVE-2026-5142

Event History

Mar 30, 2026
Data Sourced
via Red Hat·12:08 PM
DescriptionSeverityAffected Software
Jul 1, 2026
CVE Published
via MITRE·02:07 PM
Data Sourced
via MITRE·02:07 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the risk level of CVE-2026-5142?

CVE-2026-5142 has a risk level of 40, which classifies it as medium severity.

2

What is the vulnerability associated with CVE-2026-5142?

CVE-2026-5142 is a flaw that allows authenticated users to bypass taxonomy scoping and access private SSH keys from other organizations.

3

Who is affected by CVE-2026-5142?

Authenticated users with 'view_keypairs' permission in multi-tenant environments are affected by CVE-2026-5142.

4

How can CVE-2026-5142 be mitigated?

To mitigate CVE-2026-5142, restrict 'view_keypairs' permissions and ensure proper taxonomy scoping enforcement.

5

What software is impacted by CVE-2026-5142?

CVE-2026-5142 affects the Foreman software as well as Red Hat Satellite.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203