Vulnerability Description
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | >= 6.16, < 6.16.10 |
| Redhat | Enterprise Linux | 8.0 |
| Theforeman | Foreman | < 3.18.2 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:34365Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34366Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34367Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34368Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5135Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452230Issue TrackingVendor Advisory
FAQ
What is CVE-2026-5135?
CVE-2026-5135 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is...
How severe is CVE-2026-5135?
CVE-2026-5135 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-5135?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Satellite, Redhat Enterprise Linux, Theforeman Foreman.