CVE-2026-5135: Foreman Broken Access Control via Lookup Value Override Retargeting

Technical summary

CVE-2026-5135 is a broken access control vulnerability (CWE-639) in Foreman that manifests during lookup value override management. The vulnerability arises because authorization checks do not adequately validate that a user's permission to edit a specific host extends to retargeting its associated lookup overrides. An authenticated attacker with host-edit privileges can modify the match field of a lookup value override by leveraging nested host attributes, causing the system to apply configuration changes intended for one host to an unrelated target. The CVSS v3.1 score of 6.5 (MEDIUM severity) reflects high integrity impact with low attack complexity and no privilege escalation requirement, though availability and confidentiality are unaffected. The vulnerability requires network access and valid user credentials but no additional interaction once authenticated.

Business impact

In managed environments relying on Foreman for centralized host configuration, this vulnerability enables configuration drift and unauthorized policy violations. A disgruntled IT staff member or insider with basic host-editing rights could silently alter configurations on production systems outside their authorized domain—for example, modifying security settings, network parameters, or application deployments across different organizational units or customer tenants. For Red Hat Satellite deployments managing large fleets, this could affect compliance posture, system hardening standards, and multi-tenant isolation guarantees. The cross-boundary nature of the flaw means impact is not limited to a single administrative domain, amplifying risk in federated or partner-managed infrastructure.

Affected systems

The vulnerability affects Foreman and integrations dependent on it, specifically: Theforeman Foreman (all versions until patched), Red Hat Satellite (all versions that include the affected Foreman codebase), and Red Hat Enterprise Linux systems managed through Foreman/Satellite infrastructure. Organizations running Satellite as their infrastructure provisioning and configuration management backbone are directly exposed. The impact scales with the number of hosts under management and the diversity of administrative roles and organizational boundaries within a single Foreman/Satellite deployment.

Exploitability

The vulnerability is exploitable by any authenticated user with host-edit permissions—a common role in federated IT environments. No special configuration is required; the attack occurs during normal interaction with the Foreman UI or API. Exploitation does not require privilege escalation, physical access, or user interaction. The network-accessible nature and reliance only on valid credentials make this practical for insiders or compromised accounts. However, the attacker must already possess valid Foreman authentication, limiting the threat to environments where multiple administrative users have access or where account compromise is plausible.

Remediation

Remediation requires updating Foreman and Red Hat Satellite to patched versions that enforce authorization checks at the lookup value override level, ensuring users cannot retarget overrides to hosts outside their authorization scope. Red Hat has released security advisories for affected Satellite and RHEL versions; verify the specific patch versions from Red Hat's official security errata. Environments unable to patch immediately should implement complementary controls: restrict host-edit permissions to trusted personnel, audit lookup value override modifications (checking for unexpected target host changes), and enforce approval workflows for cross-boundary configuration changes if supported by the deployment.

Patch guidance

Consult Red Hat's official security advisories for Satellite and RHEL to identify patched versions. Apply updates to all Foreman and Satellite components in your environment, as the fix addresses a core authorization flaw affecting all versions. Test patches in a non-production environment first, as Foreman updates may affect running host configurations. Prioritize patching hosts managing critical infrastructure or multi-tenant systems. Red Hat Satellite environments should follow the documented update procedure for their specific version branch (e.g., Satellite 6.x vs 7.x) to ensure consistency across the managed ecosystem.

Detection guidance

Monitor Foreman audit logs for modifications to lookup value overrides, particularly changes to the match field or target host assignment. Flag cases where a user edits a lookup override for a host they should not have authorization to modify, especially cross-organizational or cross-location changes. Implement alerts for API calls to lookup value override endpoints originating from users with limited host-edit scope. Review historical override configurations to identify any unauthorized retargeting that may have occurred. In Red Hat Satellite, examine satellite-backend logs and audit trails for similar anomalies. Baseline normal override behavior in your environment and flag statistical outliers.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the vulnerability carries elevated business risk for managed infrastructure environments. The flaw enables insider threats with insider privilege and permits silent, unauthorized configuration changes across organizational boundaries—potentially violating compliance controls (SOX, PCI, HIPAA depending on workloads) and undermining multi-tenant isolation. In Satellite-managed environments, this could affect hundreds or thousands of systems. The flaw is not publicly exploited (KEV status: not yet included) but is easily exploitable by authorized users, making rapid patching essential in organizations with diverse IT staff or third-party administrators. Prioritize patching based on tenant boundary sensitivity and the number of administrative users in your Foreman/Satellite deployment.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects a network-accessible vulnerability with low attack complexity and no privilege escalation, but limited to authenticated users (PR:L). The integrity impact is rated high because unauthorized modification of host configurations directly violates configuration integrity. Confidentiality and availability are not directly affected. The MEDIUM severity is appropriate for a scenario where the attacker must already have valid credentials; however, in organizations where Foreman access is widespread or where account compromise is a concern, the practical risk may be higher than the base score suggests.

Frequently asked questions