CVE-2026-5135mediumCWE-639

CVE-2026-5135: fallo de gravedad media en Red Hat Satellite 6

Foreman: foreman: unauthorized modification of host configurations via broken access control

Publicada el

Seguir esta CVE+ Monitorear Red Hat Satellite

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Red Hat · Red Hat Satellite 6Red Hat · Red Hat Satellite 6.16 for RHEL 8Red Hat · Red Hat Satellite 6.16 for RHEL 9Red Hat · Red Hat Satellite 6.17 for RHEL 9Red Hat · Red Hat Satellite 6.18 for RHEL 9Red Hat · Red Hat Satellite 6.19 for RHEL 9
CVEs relacionadas — Red Hat Satellite 6

En el mismo producto, de las más peligrosas a las menos.

CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2022-3874HIGHOs command injection via ct_command and fcct_commandEPSS 2.2%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 1.5%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%