---
id: CVE-2026-96659
title: A flaw was found in Foreman
summary: >-
  A flaw was found in Foreman. This vulnerability allows an authenticated user
  with low-level Viewer permissions to cause unauthorized information disclosure
  by submitting requests to template preview endpoints. By exploiting this
  issue, t…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L'
cwe:
  - CWE-267
vendor: redhat
product: satellite
affected:
  - 'satellite >= 6.16, < 6.16.4'
  - 'satellite >= 6.17, < 6.17.12'
  - 'satellite >= 6.19, < 6.19.5'
  - 'foreman >= 1.9.0, <= 3.19.1'
  - foreman = 5.0.0
  - 'satellite >= 6.18, < 6.18.10'
patched:
  - satellite 6.18.10
published: '2026-10-01'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T13:33:44.607'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96659'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:74503'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74504'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74505'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74506'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-96659'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536844'
    label: secalert@redhat.com
  - url: 'http://www.openwall.com/lists/oss-security/2026/10/07/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96659.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-96659'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96659'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00347
epssPercentile: 0.28073
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T01:48:42.549755Z'
ingestedAt: '2026-10-01T18:55:42.367Z'
---

## Overview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

## Affected

- `satellite >= 6.16, < 6.16.4`
- `satellite >= 6.17, < 6.17.12`
- `satellite >= 6.19, < 6.19.5`
- `foreman >= 1.9.0, <= 3.19.1`
- `foreman = 5.0.0`
- `satellite >= 6.18, < 6.18.10`

## Remediation

Upgrade past the affected range:

- `satellite 6.18.10`

## Vendor advisories

- **RHSA-2026:74506** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74506)
- **RHSA-2026:74504** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74504)
- **RHSA-2026:74503** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74503)
- **RHSA-2026:74505** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74505)