Red Hat Satellite 6 allows local user of instance to read cache files. These credentials give full access via the API and local user on the foreman server can gain complete access of the instance.
This flaw can be mitigated by manually changing the directory permissions to remove readable bits for the others:
# chmod 0750 /run/foreman
Name: Foreman project
Upstream: Ewoud Kohl van Wijngaarden (Red Hat)
Please ignore comment 5 and comment 6 as these were meant for https://bugzilla.redhat.com/show_bug.cgi?id=1858302