{"id":"CVE-2026-107443","title":"Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)","summary":"A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. T…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"Red Hat","product":"foreman","affected":["foreman (all versions)","foreman (all versions)","foreman (all versions)","foreman (all versions)","foreman (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-13T00:30:22.181500Z"},"published":"2026-11-12","updated":"2026-11-13","sourceUpdated":"2026-11-13T16:58:34.823Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107443","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:100120","label":"RHSA-2026:100120"},{"url":"https://access.redhat.com/errata/RHSA-2026:99949","label":"RHSA-2026:99949"},{"url":"https://access.redhat.com/errata/RHSA-2026:99950","label":"RHSA-2026:99950"},{"url":"https://access.redhat.com/errata/RHSA-2026:99952","label":"RHSA-2026:99952"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107443"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547760","label":"RHBZ#2547760"}],"tags":["cve.org"],"epss":0.00519,"epssPercentile":0.44664,"ingestedAt":"2026-11-12T20:54:37.329Z","slug":"CVE-2026-107443","body":"## Overview\n\nA flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.\n\n## Affected\n\n- `foreman (all versions)`\n- `foreman (all versions)`\n- `foreman (all versions)`\n- `foreman (all versions)`\n- `foreman (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nUntil a fix is deployed, remove view_hosts from untrusted users or block/restrict GET /api/v2/hosts/:id/template/:kind. Prefer granting only trusted administrators access that can view host provisioning output. Rotate host root credentials if Viewer-role users may have accessed this endpoint.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}