CVE-2026-96659: Foreman: excessive permissions for viewer role on preview
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Other sources
When accessing certain API endpoints (e.g. POSTing to /template/preview) a user with the Viewer role is able to access information they should not be able to (i.e. @host.rootpass). When the system is configured insecurely (i.e. Safemode is disabled), or a Safemode bypass vulnerability exists, then the Viewer is able to perform Remote Code Execution on the system as the foreman system account.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which environments face the highest impact?
Any Foreman deployment where users have the Viewer role and can submit requests to template preview endpoints is exposed to unauthorized disclosure of data available through template context, including host root passwords. The impact escalates to command execution as the Foreman system account if Safemode is disabled or if another Safemode bypass is present.
What access does an attacker need?
The attacker must be authenticated and have the low-privilege Viewer role. No user interaction is required after authentication; the issue is triggered through template preview API requests such as POST requests to /template/preview.
What can be done if updates cannot be applied immediately?
Ensure Safemode protections are enabled, since disabling Safemode can turn the disclosure issue into remote code execution. Also limit assignment of the Viewer role and restrict access to template preview endpoints where operationally possible.
How can administrators assess exposure?
Review whether Viewer-role accounts can access template preview functionality, including POST /template/preview, and whether preview output can expose sensitive host data such as @host.root_pass. Verify that Safemode is enabled and investigate any known Safemode bypasses, as either condition can permit command execution.