Sensitive Information Disclosure in Foreman via GraphQL API

CVE-2024-6861

Summary

A vulnerability exists in Foreman that allows attackers to exploit the GraphQL API when the introspection feature is enabled. This flaw can lead to the unauthorized retrieval of sensitive admin authentication keys. The exposure of these keys could enable attackers to compromise the integrity of the entire API, potentially leading to further exploitation of the system. Organizations using Foreman must ensure their GraphQL configurations are secured to prevent this critical information leak.

References