REDHAT-BUG-2535903: Medium severity foreman_ansible vulnerability
The Ansible inventory API in foremanansible builds its host set via Host.where(conditionkey => ids) in the showinventory private method of AnsibleInventoriesController. The beforeaction :authorize filter only confirms the caller holds a viewhosts permission covering the controller action; it does not apply any filter attached to that permission. The taxonomy default scope on Host::Base limits results to the caller's organizations and locations, so this does not cross org/location boundaries. However, a user whose viewhosts is narrowed by a filter (e.g., hostgroup, lifecycle environment, or name pattern) can supply arbitrary host IDs within their organizations and receive full Ansible inventory including parameters flagged as hidden (real values, not masked) and Ansible variable values with hiddenvalue? set.
The correctly scoped pattern Host.authorized(:viewhosts) is used elsewhere in the same plugin (ApiCommon#findhostansiblerole). The built-in "Ansible Tower Inventory Reader" role includes viewhosts, making the endpoint reachable without custom roles. No non-default configuration is required.
Introduced in foremanansible 3.0.1 (commit 13a1529, 2019-06-27, PR #265) when the inventory preview feature was first created. All versions from 3.0.1 through at least 18.0.2 are affected.
Affected Software
Event History
Frequently Asked Questions
What level of access is needed to retrieve inventory outside a user's intended host filter?
The caller needs view_hosts permission and must be able to reach the inventory endpoint. The built-in Ansible Tower Inventory Reader role includes view_hosts, so custom roles are not required; the caller can supply arbitrary host IDs within their permitted organizations and locations.
Can this expose hosts in other organizations or locations?
No. The taxonomy default scope on Host::Base still limits returned hosts to the caller's organizations and locations. The bypass applies to narrower view_hosts filters, such as hostgroup, lifecycle environment, or name-pattern restrictions.
What sensitive information may be disclosed?
Affected inventory responses can include full Ansible inventory data, including parameters marked hidden with their real values rather than masked values. Ansible variable values for which hidden_value? is set can also be returned.
Is a non-default configuration needed for exposure?
No. The issue does not require non-default configuration, and the built-in Ansible Tower Inventory Reader role makes the endpoint reachable for users assigned that role.