CVE-2026-9073 — MEDIUM (6.2)

Vulnerability Description

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.

CVSS Score

6.2

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Satellite	6.19
Theforeman	Foreman	-

Related Weaknesses (CWE)

CWE-532

References

https://access.redhat.com/errata/RHSA-2026:28405
https://access.redhat.com/errata/RHSA-2026:28438Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-9073Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480151Vendor Advisory

FAQ

What is CVE-2026-9073?

CVE-2026-9073 is a vulnerability with a CVSS score of 6.2 (MEDIUM). A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which...

How severe is CVE-2026-9073?

CVE-2026-9073 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-9073?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Satellite, Theforeman Foreman.