CVE-2026-5142: Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-01 · updated 2026-07-09
Weakness: CWE-639

Description

A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.

Affected products

Red Hat Satellite 6: from 6.18 before 6.18.7; from 6.16 before 6.16.10; from 6.17 before 6.17.9; from 6.19 before 6.19.2 — fixed in 6.16.10, 6.17.9, 6.18.7, 6.19.2
foreman: before 3.18.2; from 3.19.0 before 3.19.1 — fixed in 3.18.2, 3.19.1

How to fix

Upgrade to a fixed version: Red Hat Satellite 6 6.16.10, 6.17.9, 6.18.7, 6.19.2; foreman 3.18.2, 3.19.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-5142 or the next vulnerability affects your stack