AI analysis
A flaw in Foreman lets an authenticated user who has only low-level Viewer permissions disclose sensitive information by sending requests to template preview endpoints. Data returned this way can include host root passwords and other secrets that templates render. If Safemode protections have been disabled, the same flaw may also let that user run arbitrary commands as the Foreman system account. Foreman deployments that grant Viewer or similar preview access are affected; the advisory does not state a version range. No public proof-of-concept is known, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Install the Foreman security update from the project or your vendor for the release you run as soon as it is published. Until then, restrict which accounts have Viewer or other roles that can call template preview, confirm Safemode rendering is enabled, and rotate host root passwords and any other secrets that may have been rendered in previews.
Estimated exposure
moderateon the order of thousands of Foreman servers (mostly internal) — No install count or version range is given in the advisory. The figure is an order-of-magnitude estimate from Foreman’s role as an enterprise server-lifecycle platform, deployed per organization and usually on internal networks rather than…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.