Bug #39479: CVE-2026-5142: Cross-tenant private SSH key disclosure via taxonomy scoping bypass - Foreman

Actions

Copy link

Bug #39479

closed

CVE-2026-5142: Cross-tenant private SSH key disclosure via taxonomy scoping bypass

Added by Ondřej Gajdušek 16 days ago. Updated 16 days ago.

Status:

Closed

Priority:

Immediate

Assignee:

Category:

Security

Target version:

Difficulty:

Triaged:

Bugzilla link:

Pull request:

https://github.com/theforeman/foreman/pull/11067, https://github.com/theforeman/foreman/pull/11068, https://github.com/theforeman/foreman/pull/11069

Fixed in Releases:

3.18.2, 3.19.1, 5.0.0

Found in Releases:

Red Hat JIRA:

SAT-43820

Description

A broken access control vulnerability was found in Foreman's KeyPairsController#show action. The show action is excluded from the find_compute_resource callback that enforces taxonomy scoping on all other key pair actions. This allows an authenticated user with the view_keypairs permission (included in the built-in Viewer role) to download the full PEM private key of any compute resource by database ID, bypassing organization and location boundaries.

CVSS: 6.5 (Moderate)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-639

Credit: Stanislav Fot (Aisle Research)