CVE-2026-92893: Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters
A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.
Other sources
The Ansible inventory API in foremanansible builds its host set via Host.where(conditionkey => ids) in the showinventory private method of AnsibleInventoriesController. The beforeaction :authorize filter only confirms the caller holds a viewhosts permission covering the controller action; it does not apply any filter attached to that permission. The taxonomy default scope on Host::Base limits results to the caller's organizations and locations, so this does not cross org/location boundaries. However, a user whose viewhosts is narrowed by a filter (e.g., hostgroup, lifecycle environment, or name pattern) can supply arbitrary host IDs within their organizations and receive full Ansible inventory including parameters flagged as hidden (real values, not masked) and Ansible variable values with hiddenvalue? set.
The correctly scoped pattern Host.authorized(:viewhosts) is used elsewhere in the same plugin (ApiCommon#findhostansiblerole). The built-in "Ansible Tower Inventory Reader" role includes viewhosts, making the endpoint reachable without custom roles. No non-default configuration is required.
Introduced in foremanansible 3.0.1 (commit 13a1529, 2019-06-27, PR #265) when the inventory preview feature was first created. All versions from 3.0.1 through at least 18.0.2 are affected.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user must have the view_hosts permission for the inventory controller action, but that permission must be restricted by a host filter. Users with filters based on hostgroup, lifecycle environment, or host name pattern are examples of affected configurations.
What does an attacker need to do?
The attacker can submit arbitrary host IDs in the Ansible inventory API request. IDs must belong to hosts within the attacker's permitted organizations and locations.
Does this allow access to hosts in other organizations or locations?
No. The Host::Base taxonomy default scope continues to limit returned hosts to the caller's organizations and locations.
What information can be disclosed?
The affected API can return the full Ansible inventory for otherwise filtered hosts, including parameter values marked as hidden.