PT-2026-54785 · Red Hat · Red Hat Satellite 6+5

Stanislav Fot · Publicado 2026-07-01 · Atualizado 2026-07-01 · CVE-2026-5135

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-5135

RHSA-2026:34365

RHSA-2026:34366

RHSA-2026:34368

Produtos afetados

Red Hat Satellite 6

Red Hat Satellite 6.16 For Rhel 8

Red Hat Satellite 6.16 For Rhel 9

Red Hat Satellite 6.17 For Rhel 9

Red Hat Satellite 6.18 For Rhel 9

Red Hat Satellite 6.19 For Rhel 9

Referências · 7

• https://access.redhat.com/errata/RHSA-2026:34366 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:34367 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:34365 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:34368 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-5135 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5135 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=2452230 · Nota