CVE-2026-5142: Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass
A flaw was found in foreman. Authenticated users with 'viewkeypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
Other sources
KeyPairsController#show bypasses taxonomy scoping, allowing authenticated users with viewkeypairs permission to download private SSH keys across organizations by directly querying key pair IDs. This results in cross-tenant data exposure in multi-tenant deployments.
Requirements to exploit:
Authenticated user account Permission viewkeypairs (e.g., via Viewer role) Ability to guess or enumerate KeyPair IDs (low complexity due to predictable IDs)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5135 - Upgrade
Upgrade
foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5136 - Upgrade
Upgrade
foremanto a version that resolves this vulnerability.Fixed in 3.18.2Patch CVE-2026-5138 - Upgrade
Upgrade
foremanto a version that resolves this vulnerability.Fixed in 3.19.1Patch CVE-2026-5142
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-5142?
CVE-2026-5142 has a risk level of 40, which classifies it as medium severity.
What is the vulnerability associated with CVE-2026-5142?
CVE-2026-5142 is a flaw that allows authenticated users to bypass taxonomy scoping and access private SSH keys from other organizations.
Who is affected by CVE-2026-5142?
Authenticated users with 'view_keypairs' permission in multi-tenant environments are affected by CVE-2026-5142.
How can CVE-2026-5142 be mitigated?
To mitigate CVE-2026-5142, restrict 'view_keypairs' permissions and ensure proper taxonomy scoping enforcement.
What software is impacted by CVE-2026-5142?
CVE-2026-5142 affects the Foreman software as well as Red Hat Satellite.