Access Control Flaw in Foreman Remote Execution Plugin by Red Hat
CVE-2026-92904

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6
Vendor
CVE Published:
17 September 2026

What is CVE-2026-92904?

A security issue has been identified in the Foreman Remote Execution plugin where the controller responsible for template invocations does not adequately apply access permissions during job invocation resolution. Specifically, the 'show_template_invocation_by_host' action fails to validate the user's permissions to view specific job invocations. This oversight allows authenticated users to potentially exploit this flaw, leading to the enumeration of job invocation IDs and unauthorized access to sensitive job output data, including rendered scripts and input values for job invocations owned by other users within the same organization.

References

https://access.redhat.com/security/cve/CVE-2026-92904
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2535942
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Arpit Jain, Independent Security Researcher (arpitjain099). for reporting this issue.
.