CVE-2026-5138: Foreman Cross-Tenant Information Disclosure via Authorization Bypass

Technical summary

CVE-2026-5138 is an authorization bypass vulnerability in Foreman's taxonomy_scope controller method. The vulnerability stems from insufficient validation of organization and location IDs passed in nested request parameters. An authenticated user with host-edit permissions can craft requests that bypass existing authorization checks, allowing them to enumerate and retrieve sensitive infrastructure metadata from out-of-scope tenants. The vulnerability falls under CWE-639 (Authorization Bypass Through User-Controlled Key), indicating a flawed access control mechanism tied to request-controlled identifiers. The CVSS 3.1 score of 4.3 (Medium severity) reflects low attack complexity, network accessibility, and confidentiality impact, with no integrity or availability compromise.

Business impact

In multi-tenant Foreman deployments, this vulnerability could expose critical infrastructure blueprints to competing business units or unauthorized administrators. Network topology, IP addressing schemes, and VLAN designs are often considered sensitive operational security data. Compromise of this information could enable network reconnaissance, facilitate lateral movement planning, or support supply-chain intelligence gathering. Compliance frameworks (SOC 2, FedRAMP, PCI DSS) typically require strict tenant isolation; this flaw creates evidence of control breakdown that could complicate audit outcomes. The risk is elevated in environments hosting multiple customers or business units on shared Foreman infrastructure.

Affected systems

The vulnerability affects Foreman and Red Hat Satellite (which is based on Foreman). Specific patched versions have not been disclosed in this advisory; verify the Red Hat security advisory for affected version ranges and remediation guidance. Red Hat Enterprise Linux systems running these products as components are in scope. Organizations using Foreman in standalone or Satellite deployments with multi-tenant configurations or role-based access controls are most directly affected.

Exploitability

Exploitation requires valid Foreman credentials with host-edit permissions, placing this in the authenticated threat category. The attack complexity is low—an attacker simply needs to manipulate nested request parameters pointing to out-of-scope organization or location IDs. No special tools, timing windows, or user interaction are needed. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication, suggesting no observed active exploitation in the wild at the time of disclosure. However, the straightforward nature of the attack (parameter manipulation) means exploitation tooling could be developed quickly once details become public.

Remediation

Remediation requires patching Foreman and Red Hat Satellite to versions that properly validate organization and location IDs before returning sensitive metadata. Additionally, review and reinforce role-based access control (RBAC) policies within Foreman to ensure host-edit permissions do not unintentionally grant cross-tenant visibility. For immediate risk reduction pending patches, audit Foreman API logs and controller access patterns to detect suspicious multi-tenant parameter enumeration attempts. Consider restricting host-edit role membership to only trusted administrators and implementing network segmentation to limit access to Foreman API endpoints.

Patch guidance

Check the Red Hat security advisory (linked in vendor guidance) for specific patched versions and release timelines. Apply updates to both Foreman and Red Hat Satellite infrastructure management components. Test patches in a staging environment first to confirm compatibility with existing Foreman integrations, satellite configurations, and dependent systems. After patching, verify that authorization checks properly reject cross-tenant metadata requests by testing with a host-edit user account against out-of-scope organization and location IDs.

Detection guidance

Monitor Foreman API logs (typically in /var/log/foreman/production.log or Satellite audit logs) for repeated requests to the taxonomy_scope controller with varying organization and location ID parameters. Look for 200 or 304 responses (successful data retrieval) when the requesting user's assigned organization or location ID does not match the request parameters. Enable detailed audit logging in Foreman's settings to capture all parameter submissions. Alert on patterns suggesting enumeration: multiple rapid requests targeting different organization/location IDs from a single host-edit user account within a short time window. Correlate such activity with user privilege review to identify potential data exfiltration.

Why prioritize this

Although the CVSS score is Medium (4.3), prioritization should account for the sensitive nature of infrastructure metadata at risk. In multi-tenant environments, tenant isolation is a core security control. This vulnerability directly undermines that control. Organizations with strict compliance requirements, those hosting multiple customers on shared Foreman infrastructure, or those storing critical network topology data should prioritize patching and immediate detection efforts. Environments with single-tenant or isolated Foreman deployments may deprioritize slightly, though the flaw still warrants timely remediation to reduce insider-threat surface area.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the attack vector (network-accessible), attack complexity (low), privilege requirement (authenticated), user interaction requirement (none), and impact scope (unchanged). The confidentiality impact is rated Low because the leaked data (subnet topology, IP ranges, gateway, DNS, VLAN) is infrastructure configuration rather than user secrets or credentials. However, real-world risk elevation occurs in multi-tenant or highly regulated environments where infrastructure metadata exposure triggers compliance violations or enables follow-on attacks. Organizations should consider context-specific risk ratings above the base CVSS score if they host multiple tenants or treat network topology as a protected asset.

Frequently asked questions