CVE-2026-107443 · Other
NO FIX YET
An authenticated user with view_hosts privileges can call the hosts template API and retrieve rendered provisioning templates for a host. The rendered output can include sensitive data such as the host root password.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Foreman (or Red Hat Satellite) for host provisioning where users beyond trusted admins hold view_hosts, such as the Viewer role. Those users can call the hosts template API and read rendered provisioning output including the host root password. This is an incomplete fix of CVE-2026-96659; installs where view_hosts is limited to trusted staff can skip it.
Not affected if no-untrusted-viewer-users
Who cares api, foreman, provisioning, satellite, self-hosted
No fix yet, per the sources.
A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.