{"id":"CVE-2026-5142","state":"PUBLISHED","title":"Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass","description":"A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.","publishedAt":"2026-07-01T14:07:55.662Z","updatedAt":"2026-07-01T23:53:16.614Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Satellite 6.16 for RHEL 8","Red Hat Red Hat Satellite 6.16 for RHEL 9","Red Hat Red Hat Satellite 6.17 for RHEL 9","Red Hat Red Hat Satellite 6.18 for RHEL 9","Red Hat Red Hat Satellite 6.19 for RHEL 9","Red Hat Red Hat Satellite 6"],"affected":[{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.17-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_maintenance:6.16::el8","cpe:/a:redhat:satellite_maintenance:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.17-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_maintenance:6.16::el8","cpe:/a:redhat:satellite_maintenance:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.14.0.17-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.16.0.17-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.18.0.7-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_maintenance:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite-capsule:el8/foreman","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"]}],"references":["https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:34366","https://access.redhat.com/errata/RHSA-2026:34367","https://access.redhat.com/errata/RHSA-2026:34368","https://access.redhat.com/security/cve/CVE-2026-5142","https://bugzilla.redhat.com/show_bug.cgi?id=2452999"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5142.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5142","state":"PUBLISHED","datePublished":"2026-07-01T14:07:55.662Z","dateUpdated":"2026-07-01T23:53:16.614Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-03-30T12:08:56.764Z"},"containers":{"cna":{"title":"Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass","descriptions":[{"lang":"en","value":"A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.17-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_maintenance:6.16::el8","cpe:/a:redhat:satellite_maintenance:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.17-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_maintenance:6.16::el8","cpe:/a:redhat:satellite_maintenance:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.14.0.17-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.16.0.17-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.18.0.7-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_maintenance:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite-capsule:el8/foreman","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:34365","name":"RHSA-2026:34365","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34366","name":"RHSA-2026:34366","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34367","name":"RHSA-2026:34367","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34368","name":"RHSA-2026:34368","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5142","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452999","name":"RHBZ#2452999","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-07-01T23:53:16.614Z"},"datePublic":"2026-04-30T12:34:00.000Z","x_redhatCweChain":"CWE-639: Authorization Bypass Through User-Controlled Key","timeline":[{"lang":"en","time":"2026-03-30T12:04:45.283Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-30T12:34:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Stanislav Fot (Aisle Research) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-01T15:01:12.115967Z","id":"CVE-2026-5142","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-01T15:01:19.821Z"}}]}}}