CVE-2026-5142: Foreman SSH Key Exposure via Authorization Bypass

Technical summary

CVE-2026-5142 is an authorization bypass in Foreman stemming from insufficient taxonomy scoping validation. The vulnerability exists in the key pair retrieval mechanism, where the application fails to enforce organization boundaries when responding to direct key pair ID queries. An authenticated attacker with 'view_keypairs' permission can enumerate or directly access key pair resources belonging to other tenants, bypassing intended multi-tenant controls. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), indicating a fundamental flaw in how access control decisions reference tenant context.

Business impact

In multi-tenant Foreman deployments, this vulnerability creates a cross-tenant data exposure risk with severe confidentiality implications. Compromised SSH keys can be leveraged to gain unauthorized access to infrastructure managed by other organizations, potentially leading to lateral movement, data theft, or supply chain attacks. Organizations hosting multiple customers or business units on shared Foreman instances face exposure of their customers' or divisions' critical authentication material. The impact is amplified in environments where SSH key rotation is infrequent or where those keys control access to production systems.

Affected systems

The vulnerability affects Foreman and Red Hat Satellite (which includes Foreman as a component). Red Hat Enterprise Linux systems running affected Foreman or Satellite versions are in scope. Multi-tenant deployments are at greatest risk; single-tenant instances with limited user access may face reduced exposure depending on user permissions and key management practices.

Exploitability

Exploitation requires valid authentication and the 'view_keypairs' permission role—a relatively low barrier in environments where Foreman access is broadly distributed to operations or infrastructure teams. No user interaction is required; the attacker can directly query the Foreman API with key pair IDs to retrieve credentials. The attack is trivial to execute once credentials are obtained, making post-breach key enumeration a realistic threat. However, the attacker must first gain Foreman authentication, which is a prerequisite. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network accessibility, low attack complexity, and high confidentiality impact constrained by the requirement for valid credentials.

Remediation

Apply Foreman patches that enforce proper taxonomy (organization) scoping in the key pair access control logic. Red Hat will release updates for Satellite and related RHEL packages; verify current patch availability through Red Hat's security advisories and errata. Until patches are available, restrict 'view_keypairs' permission to trusted administrators and implement network-level access controls to limit Foreman API exposure. Audit key pair access logs to identify unauthorized enumeration attempts. Consider rotating SSH keys that may have been exposed, particularly in multi-tenant environments.

Patch guidance

Monitor Red Hat Security Advisories (RHSA) for published fixes addressing CVE-2026-5142 in Foreman and Red Hat Satellite. Apply patches to all affected Foreman instances and Satellite servers as they become available. Test patches in a non-production environment first to ensure compatibility with custom integrations or workflows. After patching, verify that key pair access is properly scoped to the authenticated user's organization and that cross-tenant queries are rejected.

Detection guidance

Review Foreman audit logs and API request logs for evidence of key pair queries by users outside their assigned organization. Look for patterns of sequential key pair ID requests that may indicate enumeration. Monitor for API calls to '/api/v2/key_pairs/{id}' endpoints where the requesting user's organization does not match the target key pair's organization. If SIEM integration is in place, create alerts for unauthorized key pair access attempts. Query Foreman's database directly to identify which users have accessed which key pairs and cross-reference against organization assignments.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the vulnerability warrants prompt prioritization because it involves exposure of cryptographic credentials with operational impact. SSH keys directly enable infrastructure compromise, making this a critical data loss and access control issue despite the authentication prerequisite. Organizations with multi-tenant Foreman setups should treat this as HIGH priority. The lack of KEV designation suggests limited current exploitation, but the low complexity of the attack and high value of SSH keys make this an attractive target for opportunistic attackers with Foreman access.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: (1) network-accessible attack vector—the Foreman API is typically exposed over the network; (2) low attack complexity—direct key pair queries require no special conditions; (3) requirement for low-level privilege—'view_keypairs' permission is a basic role; (4) high confidentiality impact—SSH private keys are highly sensitive; (5) no integrity or availability impact—the attack is read-only. The score appropriately captures the authentication gate but may underrepresent risk in environments where SSH keys control critical infrastructure. Organizations should apply contextual risk scoring based on how many users hold 'view_keypairs' permission and the sensitivity of managed infrastructure.

Frequently asked questions