Authorization Flaw in Foreman Ansible Plugin Affects Ansible Variables Management

CVE-2026-92894

What is CVE-2026-92894?

A vulnerability exists in the Ansible override values API of the Foreman Ansible plugin. This flaw allows an authenticated user, who possesses the edit_ansible_variables permission, to delete any LookupValue record by ID without adequate verification. Specifically, the destroy action improperly resolves the target LookupValue, permitting the deletion of override values for Ansible variables that lie outside the caller's permission scope. This can also include override values linked to Puppet smart class parameters, exposing significant security risks in variable management.

References