PT-2026-54788 · Red Hat · Red Hat Satellite 6+5

Stanislav Fot · Publicado 2026-07-01 · Atualizado 2026-07-01 · CVE-2026-5142

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in foreman. Authenticated users with 'view keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-5142

RHSA-2026:34365

RHSA-2026:34366

RHSA-2026:34368

Produtos afetados

Red Hat Satellite 6

Red Hat Satellite 6.16 For Rhel 8

Red Hat Satellite 6.16 For Rhel 9

Red Hat Satellite 6.17 For Rhel 9

Red Hat Satellite 6.18 For Rhel 9

Red Hat Satellite 6.19 For Rhel 9

Referências · 7

• https://access.redhat.com/errata/RHSA-2026:34366 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-5142 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=2452999 · Nota
• https://access.redhat.com/errata/RHSA-2026:34365 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:34368 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:34367 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-5142 · Nota