Project

General

Profile

Actions
Copy link

Bug #39479

closed

CVE-2026-5142: Cross-tenant private SSH key disclosure via taxonomy scoping bypass

Added by Ondřej Gajdušek about 1 month ago. Updated about 1 month ago.

Status:
Closed
Priority:
Immediate
Assignee:
-
Category:
Security
Target version:
-
Difficulty:
Triaged:
No
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman/pull/11067, https://github.com/theforeman/foreman/pull/11068, https://github.com/theforeman/foreman/pull/11069
Fixed in Releases:
3.18.2, 3.19.1, 5.0.0
Found in Releases:
Red Hat JIRA:
SAT-43820

Description

A broken access control vulnerability was found in Foreman's KeyPairsController#show action. The show action is excluded from the find_compute_resource callback that enforces taxonomy scoping on all other key pair actions. This allows an authenticated user with the view_keypairs permission (included in the built-in Viewer role) to download the full PEM private key of any compute resource by database ID, bypassing organization and location boundaries.

CVSS: 6.5 (Moderate)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-639

Credit: Stanislav Fot (Aisle Research)

Actions
Copy link

Also available in: Atom PDF