Cross-Tenant Information Disclosure Vulnerability in Foreman by Red Hat
CVE-2026-5138

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6.16 For Rhel 8
Red Hat Satellite 6.16 For Rhel 9
Red Hat Satellite 6.18 For Rhel 9
Red Hat Satellite 6
Vendor
CVE Published:
1 July 2026

What is CVE-2026-5138?

A vulnerability exists in Foreman that allows an authenticated user with host-edit permissions to exploit a cross-tenant information disclosure flaw. The issue arises due to insufficient validation of organization and location IDs in the taxonomy_scope controller method. This oversight enables users to bypass authorization checks and access sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs from unauthorized organizations and locations.

Affected Version(s)

Red Hat Satellite 6.16 for RHEL 8 0:3.12.0.17-1.el8sat

Red Hat Satellite 6.16 for RHEL 9 0:3.12.0.17-1.el9sat

Red Hat Satellite 6.18 for RHEL 9 0:3.16.0.17-1.el9sat

References

https://access.redhat.com/errata/RHSA-2026:34367
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34368
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-5138
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Stanislav Fot (Aisle Research) for reporting this issue.
.