PT-2026-54788 · Red Hat · Red Hat Satellite 6+5

Stanislav Fot · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-5142

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in foreman. Authenticated users with 'view keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5142

RHSA-2026:34365

RHSA-2026:34366

RHSA-2026:34368

Affected Products

Red Hat Satellite 6

Red Hat Satellite 6.16 For Rhel 8

Red Hat Satellite 6.16 For Rhel 9

Red Hat Satellite 6.17 For Rhel 9

Red Hat Satellite 6.18 For Rhel 9

Red Hat Satellite 6.19 For Rhel 9

References · 7

• https://access.redhat.com/errata/RHSA-2026:34366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5142 · Security Note
• https://access.redhat.com/errata/RHSA-2026:34365 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34368 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34367 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2452999 · Note
• https://access.redhat.com/security/cve/CVE-2026-5142 · Note