Bug 2529291 (CVE-2026-86324)

Summary: CVE-2026-86324 foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, lblicha, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-15   

Description OSIDB Bzimport 2026-09-07 06:27:07 UTC 
Foreman contains an authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController. The controller resolves the target user through User.find(params[:user_id]) without enforcing the required parent-user authorization. Consequently, a user with the create_ssh_keys permission can create an SSH key associated with another user accessible within the attacker's taxonomy scope.

The vulnerable endpoint is POST /api/v2/users/:user_id /ssh_keys. Because the target user is not validated against the caller's authorization scope before the SSH key is created, an attacker can supply another user's ID and inject their own public SSH key into that account.

The injected key is subsequently used by Foreman when provisioning hosts associated with the victim user through the sshkey provisioning snippet. This can cause the attacker's public key to be installed for the victim's managed systems, allowing the attacker to authenticate to those hosts with the corresponding private key.

Successful exploitation therefore allows a lower-privileged user with create_ssh_keys permission to modify another user's SSH configuration and potentially obtain SSH access to systems managed or provisioned by that user. The vulnerability results from missing authorization of the parent user before creating the child SSH-key resource.