CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1)
Foreman Viewer role can access extra data via template preview and, if Safemode is off, reach code execution.
Foreman fixed CVE-2026-96659, which grants the Viewer role excessive access through template preview. Viewers can reach data outside intended authorization boundaries. Where Safemode is disabled or bypassed, the same path can lead to code execution as the Foreman service account. Affected versions start at Foreman 1.9.0, and the fix ships in 3.19.2 and 5.0.1. Active exploitation is not reported.
- The Viewer role can read data through template preview beyond intended limits.
- If Safemode is disabled or bypassed, preview can yield code execution.
- Code would run as the Foreman service account.
- Affects Foreman from 1.9.0; fixed in 3.19.2 and 5.0.1.
Vulnerabilities mentionedAll →
- CVE-2026-966599.1—Low-privilege info disclosure in Foreman template previewpublished · Foreman Project Foreman
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-96659 | Low-privilege info disclosure in Foreman template preview A flaw in Foreman lets an authenticated user who has only low-level Viewer permissions disclose sensitive information by sending requests to template preview endpoints. Data returned this way can include host root passwords and other secrets that templates render. If Safemode protections have been disabled, the same flaw may also let that user run arbitrary commands as the Foreman system account. Foreman deployments that grant Viewer or similar preview access are affected; the advisory does not state a version range. No public proof-of-concept is known, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. Do: Install the Foreman security update from the project or your vendor for the release you run as soon as it is published. Until then, restrict which accounts have Viewer or other roles that can call template preview, confirm Safemode rendering is enabled, and rotate host root passwords and any other secrets that may have been rendered in previews. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-96659: Foreman: excessive Viewer permissions on preview The Viewer role can access data through template preview beyond intended authorization boundaries. In configurations where Safemode is disabled or bypassed, this can lead to code execution as the Foreman service account. Affected versions: Foreman 1.9.0...
This source does not provide full text. Read it at seclists.org.