CVE-2024-6861: Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-06 · updated 2026-06-17
Weakness: CWE-200

Description

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Affected products

Red Hat Satellite 6.12 for RHEL 8: all versions — fixed in 0:3.3.0.17-1.el8sat

How to fix

Upgrade to a fixed version: Red Hat Satellite 6.12 for RHEL 8 0:3.3.0.17-1.el8sat. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2022:8506
https://access.redhat.com/security/cve/CVE-2024-6861
https://bugzilla.redhat.com/show_bug.cgi?id=2317450
https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2
https://projects.theforeman.org/issues/34328

Get alerted when CVE-2024-6861 or the next vulnerability affects your stack