Bug 2547760 (CVE-2026-107443) - CVE-2026-107443 foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix)
Summary: CVE-2026-107443 foreman: foreman: API host template render discloses secrets ...
Keywords:
Status: NEW
Alias: CVE-2026-107443
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 02:39 UTC by OSIDB Bzimport
Modified: 2026-11-12 18:48 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 02:39:54 UTC 
A flaw was found in Foreman. The remediation for CVE-2026-96659 restricted only the web UI TemplatesController#preview action to edit/create privileges. The REST API endpoint GET /api/v2/hosts/:id/template/:kind remains authorized by the low-privilege view_hosts permission and still renders the host's provisioning template in host scope. An authenticated Viewer can therefore obtain sensitive values rendered by provisioning templates, including the host root password via the root_pass helper, in the HTTP 200 JSON response.

Reported via PSIRTSUPT-25114. Credit: Sun Kimsroul (@SunKimsroul). Related: CVE-2026-96659 (UI preview path fixed; this flaw covers the remaining API host-template sink).
Note You need to log in before you can comment on or make changes to this bug.