Vulnerability in foreman_ansible Plugin Affects Ansible Inventory API by Red Hat
CVE-2026-92893

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6
Vendor
CVE Published:
17 September 2026

What is CVE-2026-92893?

An issue exists in the foreman_ansible plugin pertaining to the Ansible inventory API, where the controller constructs host queries using an unscoped Host.where method. This oversight fails to apply the caller's view_hosts permissions, enabling authenticated users with restricted host visibility to manipulate host IDs. As a result, these users can access the complete Ansible inventory for specified hosts, including sensitive parameter values that should remain concealed. Organizations using this plugin must assess their exposure and implement necessary security measures.

References

https://access.redhat.com/security/cve/CVE-2026-92893
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2535903
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Arpit Jain, Independent Security Researcher (arpitjain099) for reporting this issue.
.