CVE-2026-13316: Foreman & Red Hat Satellite SSRF Cloud Metadata Vulnerability

Technical summary

The flaw resides in Foreman's http_proxies_controller and related http_proxy configuration handling. When HTTP parameters passed to these components are inadequately validated, an authenticated high-privilege user can craft requests that cause Foreman to perform Server-Side Request Forgery attacks. This permits the attacker to reach otherwise restricted endpoints, including cloud provider metadata services (169.254.169.254 on AWS, metadata.google.internal on GCP, and equivalent Azure endpoints). The vulnerability is rooted in insufficient input validation and trust boundaries around proxy configuration (CWE-918), enabling information disclosure of cloud credentials and service account tokens.

Business impact

In cloud-native deployments, compromise of metadata service credentials can lead to lateral movement across cloud infrastructure, unauthorized access to additional services, and potential data exfiltration. Organizations running Red Hat Satellite or Foreman in AWS, GCP, or Azure environments face risk of losing control of cloud credentials embedded in instance metadata. While the requirement for high-privilege, authenticated access limits the attack surface, insider threats or compromised administrative accounts could exploit this flaw to escalate to cloud infrastructure compromise. The impact is primarily confidentiality-focused; the vulnerability does not enable direct service disruption or data modification.

Affected systems

This vulnerability affects Foreman and Red Hat Satellite instances, particularly those deployed in cloud environments (AWS, GCP, Azure). Any organization running these products with HTTP proxy configuration features enabled should inventory affected versions. The vulnerability is authentication and privilege-gated, affecting only users with high-level administrative or proxy configuration permissions.

Exploitability

The CVSS 3.1 score of 4.4 (Medium severity) reflects low exploitability constraints: the attack requires high privilege (PR:H), local or adjacent network access (AV:L), and no special conditions (AC:L). There is no user interaction requirement, meaning a malicious admin can execute this autonomously. While not simple for external threat actors to exploit due to the authentication barrier, the vulnerability is straightforward to execute once access is obtained. No known public exploits or KEV entries currently exist, but the mechanics are well-understood by attackers familiar with SSRF patterns.

Remediation

Organizations should prioritize patching affected Foreman and Red Hat Satellite instances according to vendor advisories. Immediate mitigations include: restricting HTTP proxy configuration access to essential administrators only; implementing network segmentation to prevent Foreman instances from reaching cloud metadata endpoints (e.g., via egress firewall rules blocking 169.254.169.254, metadata.google.internal, and equivalent Azure IPs); and rotating credentials stored in cloud metadata if any suspicious access is detected. For environments unable to patch immediately, disabling HTTP proxy features where not required can reduce exposure.

Patch guidance

Check Red Hat Security Advisories and Foreman project announcements for patched versions addressing CVE-2026-13316. Apply vendor patches to affected Foreman and Red Hat Satellite instances as soon as testing permits. Verify compatibility with your deployment topology before rolling out updates in production. Test proxy functionality post-patch to ensure legitimate use cases continue working. Coordinate patching with change management processes, as proxy configurations may affect outbound connectivity policies.

Detection guidance

Monitor HTTP proxy controller logs for unusual parameter values, especially those containing IP addresses or FQDN patterns associated with cloud metadata services (169.254.169.254, metadata.google.internal, etc.). Track configuration changes to http_proxies_controller settings made by high-privilege accounts. Review access logs for authenticated requests originating from administrative users attempting to configure proxies with suspicious targets. Endpoint Detection and Response (EDR) tools can flag processes spawned by Foreman attempting unexpected outbound connections to cloud metadata endpoints. Cloud provider access logs should be examined for unusual API calls using credentials that may have been exfiltrated via metadata service abuse.

Why prioritize this

Although the CVSS score is moderate (4.4), prioritize this vulnerability because it directly threatens cloud infrastructure security in organizations running Foreman or Red Hat Satellite on cloud platforms. The prerequisite of high-privilege access is a meaningful control, but insider threats and account compromise scenarios make this a realistic concern. The specificity of impact to cloud environments—where metadata credentials grant significant power—elevates practical risk beyond the numerical score. Organizations with strict network segmentation can reduce urgency; those without should treat this as high-priority.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects a Medium severity rating driven by: confidentiality impact (High) balanced against high privilege requirement (PR:H) and local/adjacent attack vector (AV:L). No integrity or availability impact is present. The score appropriately captures that while the vulnerability enables credential disclosure, it is constrained by authentication and requires privileged account access. Practical risk in cloud environments may exceed the numeric score, particularly where cloud credentials grant broad permissions.

Frequently asked questions