CVE-2026-5142
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
Products: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat Satellite 6.19 for RHEL 9, Red Hat Satellite 6
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.16 | foreman | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-cli | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-cli | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-debug | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-debug | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-dynflow-sidekiq | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-dynflow-sidekiq | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-ec2 | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-ec2 | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-journald | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-journald | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-libvirt | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-libvirt | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-openstack | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-openstack | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-ovirt | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-ovirt | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-pcp | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-pcp | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-postgresql | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-postgresql | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-redis | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-redis | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-service | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-service | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-telemetry | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-telemetry | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.16 | foreman-vmware | 0:3.12.0.17-1.el8sat |
| Red Hat satellite 6.16 | foreman-vmware | 0:3.12.0.17-1.el9sat |
| Red Hat satellite 6.17 | dynflow-utils | 0:1.6.3-1.1.el9sat |
| Red Hat satellite 6.17 | foreman | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-cli | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-debug | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-dynflow-sidekiq | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-ec2 | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-journald | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-libvirt | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-openstack | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-ovirt | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-pcp | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-postgresql | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-redis | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-service | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-telemetry | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | foreman-vmware | 0:3.14.0.17-1.el9sat |
| Red Hat satellite 6.17 | python-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.17 | python-pillow-debugsource | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.17 | python3.11-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.17 | python3.11-pillow-debuginfo | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.17 | yggdrasil-worker-forwarder | 0:0.0.3-5.el9sat |
| Red Hat satellite 6.18 | foreman | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-cli | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-debug | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-dynflow-sidekiq | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-ec2 | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-journald | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-libvirt | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-openstack | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-pcp | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-postgresql | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-redis | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-service | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-telemetry | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | foreman-vmware | 0:3.16.0.17-1.el9sat |
| Red Hat satellite 6.18 | python3.12-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.18 | python3.12-pillow-debuginfo | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.18 | python3.12-pillow-debugsource | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.18 | yggdrasil-worker-forwarder | 0:0.0.3-5.el9sat |
| Red Hat satellite 6.19 | candlepin | 0:4.7.5-1.el9sat |
| Red Hat satellite 6.19 | candlepin-selinux | 0:4.7.5-1.el9sat |
| Red Hat satellite 6.19 | foreman | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-cli | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-debug | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-dynflow-sidekiq | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-ec2 | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-journald | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-libvirt | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-openstack | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-pcp | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-postgresql | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-redis | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-service | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-telemetry | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | foreman-vmware | 0:3.18.0.7-1.el9sat |
| Red Hat satellite 6.19 | python3.12-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.19 | python3.12-pillow-debuginfo | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.19 | python3.12-pillow-debugsource | 0:12.2.0-1.el9pc |
| Red Hat satellite 6.19 | python3.12-pyjwt | 0:2.13.0-1.el9pc |
| Red Hat satellite 6.19 | python3.12-pyjwt+crypto | 0:2.13.0-1.el9pc |
| Red Hat satellite 6.19 | yggdrasil-worker-forwarder | 0:0.0.3-5.el9sat |
| Red Hat satellite capsule 6.16 | foreman | 0:3.12.0.17-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman | 0:3.12.0.17-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman-debug | 0:3.12.0.17-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman-debug | 0:3.12.0.17-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-pcp | 0:3.12.0.17-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-pcp | 0:3.12.0.17-1.el8sat |
| Red Hat satellite capsule 6.17 | dynflow-utils | 0:1.6.3-1.1.el9sat |
| Red Hat satellite capsule 6.17 | foreman | 0:3.14.0.17-1.el9sat |
| Red Hat satellite capsule 6.17 | foreman-debug | 0:3.14.0.17-1.el9sat |
| Red Hat satellite capsule 6.17 | foreman-pcp | 0:3.14.0.17-1.el9sat |
| Red Hat satellite capsule 6.17 | python-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.17 | python-pillow-debugsource | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-pillow-debuginfo | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.18 | foreman | 0:3.16.0.17-1.el9sat |
| Red Hat satellite capsule 6.18 | foreman-debug | 0:3.16.0.17-1.el9sat |
| Red Hat satellite capsule 6.18 | foreman-pcp | 0:3.16.0.17-1.el9sat |
| Red Hat satellite capsule 6.18 | python3.12-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-pillow-debuginfo | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-pillow-debugsource | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.19 | foreman | 0:3.18.0.7-1.el9sat |
| Red Hat satellite capsule 6.19 | foreman-debug | 0:3.18.0.7-1.el9sat |
| Red Hat satellite capsule 6.19 | foreman-pcp | 0:3.18.0.7-1.el9sat |
| Red Hat satellite capsule 6.19 | python3.12-pillow | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-pillow-debuginfo | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-pillow-debugsource | 0:12.2.0-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-pyjwt | 0:2.13.0-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-pyjwt+crypto | 0:2.13.0-1.el9pc |
| Red Hat satellite utils 6.16 | foreman | 0:3.12.0.17-1.el9sat |
| Red Hat satellite utils 6.16 | foreman | 0:3.12.0.17-1.el8sat |
| Red Hat satellite utils 6.16 | foreman-cli | 0:3.12.0.17-1.el8sat |
| Red Hat satellite utils 6.16 | foreman-cli | 0:3.12.0.17-1.el9sat |
| Red Hat satellite utils 6.17 | foreman | 0:3.14.0.17-1.el9sat |
| Red Hat satellite utils 6.17 | foreman-cli | 0:3.14.0.17-1.el9sat |
| Red Hat satellite utils 6.18 | foreman | 0:3.16.0.17-1.el9sat |
| Red Hat satellite utils 6.18 | foreman-cli | 0:3.16.0.17-1.el9sat |
| Red Hat satellite utils 6.19 | foreman | 0:3.18.0.7-1.el9sat |
| Red Hat satellite utils 6.19 | foreman-cli | 0:3.18.0.7-1.el9sat |