---
id: CVE-2026-107443
title: >-
  Foreman: foreman: api host template render discloses secrets to view_hosts
  users (incomplete cve-2026-96659 fix)
summary: >-
  A flaw was found in Foreman. An authenticated user with view_hosts privileges
  can retrieve rendered provisioning template content for a host via the hosts
  template API endpoint, disclosing sensitive data such as the host root
  password. T…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Red Hat
product: foreman
affected:
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
  - foreman (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-13T00:30:22.181500Z'
published: '2026-11-12'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T16:58:34.823Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107443'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:100120'
    label: 'RHSA-2026:100120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99949'
    label: 'RHSA-2026:99949'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99950'
    label: 'RHSA-2026:99950'
  - url: 'https://access.redhat.com/errata/RHSA-2026:99952'
    label: 'RHSA-2026:99952'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-107443'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-96659'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547760'
    label: RHBZ#2547760
tags:
  - cve.org
epss: 0.00519
epssPercentile: 0.44664
ingestedAt: '2026-11-12T20:54:37.329Z'
---

## Overview

A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.

## Affected

- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`
- `foreman (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Until a fix is deployed, remove view_hosts from untrusted users or block/restrict GET /api/v2/hosts/:id/template/:kind. Prefer granting only trusted administrators access that can view host provisioning output. Rotate host root credentials if Viewer-role users may have accessed this endpoint.