CVE-2026-5135

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Authorization Bypass Through User-Controlled Key pada redhat satellite, theforeman foreman. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.

Rincian

Terbit di NVD

1 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:34365 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:34366 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:34367 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:34368 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-5135 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2452230 issue tracking · advisory vendor