CVE-2026-107443High· 7.7▾ TwilightA flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. T…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
0.5% → 0.5%
A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.
foreman (all versions)foreman (all versions)foreman (all versions)foreman (all versions)foreman (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Until a fix is deployed, remove view_hosts from untrusted users or block/restrict GET /api/v2/hosts/:id/template/:kind. Prefer granting only trusted administrators access that can view host provisioning output. Rotate host root credentials if Viewer-role users may have accessed this endpoint.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86322High· 8.8Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller
CVE-2026-86324Medium· 4.3Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller
CVE-2026-86323Medium· 4.3Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller
CVE-2026-107193Medium· 6.5A flaw has been found in **permission filters** in the **foreman** package
CVE-2026-107360Critical· 9.6Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions
CVE-2026-107152High· 7.1Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed