{"id":"CVE-2026-107443","kind":"vulnerability","aliases":["CVE-2026-107443"],"related":[],"title":"Foreman: viewer-level users can read host root passwords via template API","description":"A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.","summary":"An authenticated user with view_hosts privileges can call the hosts template API and retrieve rendered provisioning templates for a host. The rendered output can include sensitive data such as the host root password.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","foreman","other","provisioning","satellite","self-hosted"],"not_affected_if":["no-untrusted-viewer-users"],"how_to_check":"Exposed if any user or token holds view_hosts (e.g. the Viewer role) and should not see host secrets: review roles in Administer > Roles/Users, and check access logs for GET /api/v2/hosts/:id/template/:kind from non-admin accounts. Affected range for this CVE is not yet published; Foreman 3.19.2/5.0.1 fix only the UI preview path (CVE-2026-96659). Workaround per Red Hat: remove view_hosts from untrusted users or block/restrict that endpoint at a reverse proxy; rotate host root credentials if Viewer-role users may have used it.","fix":null,"status":"open","published_at":"2026-11-12T20:18:15+00:00","first_seen_at":"2026-11-12T20:40:22+00:00","triaged_at":"2026-11-12T20:42:08+00:00","updated_at":"2026-11-12T20:44:56+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T20:42:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Foreman: viewer-level users can read host root passwords via template API","impact":"high","summary":"An authenticated user with view_hosts privileges can call the hosts template API and retrieve rendered provisioning templates for a host. The rendered output can include sensitive data such as the host root password.","audience":"businesses","category":"other","nicknames":[],"who_cares":["foreman","self-hosted","provisioning"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated viewers read host root passwords from rendered templates","analyst_note":"Check the Foreman security advisory and the fixed versions for CVE-2026-107443 and CVE-2026-96659; the sources give no version ranges or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-viewer-users"],"who_is_affected":"Teams running Foreman for host provisioning where users hold view_hosts permission. The flaw is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path open to Viewer-level users. Installations that restrict view_hosts to trusted staff have less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4550,"output_tokens":472,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Foreman security advisory and the fixed versions for CVE-2026-107443 and CVE-2026-96659; the sources give no version ranges or fix.","search":"'-107443':16A,19A '-2026':15A,18A,106C '-96659':107C 'api':13A,20B,40B,88C,118C 'authent':29B,69C 'author':124C 'call':36B 'content':80C 'cve':14A,17A,105C 'data':55B,92C 'disclos':90C 'endpoint':89C 'fix':103C 'flaw':63C 'foreman':1A,21B,67C 'found':65C 'harden':109C 'host':8A,27B,33B,38B,48B,59B,73C,83C,86C,96C,120C 'host-templ':119C 'includ':53B 'incomplet':102C 'left':116C 'level':4A,128C 'output':51B 'password':10A,61B,98C 'path':114C,123C 'preview':113C 'privileg':34B,74C 'provis':23B,44B,78C 'read':7A 'render':43B,50B,77C,122C 'retriev':42B,76C 'root':9A,60B,97C 'satellit':24B 'self':26B 'self-host':25B 'sensit':54B,91C 'templat':12A,39B,45B,79C,87C,121C 'ui':112C 'user':5A,30B,70C,129C 'via':11A,84C 'view':32B,72C 'viewer':3A,127C 'viewer-level':2A,126C 'web':111C","nicknames":[],"mitigations":[],"who_affected":"Teams running Foreman (or Red Hat Satellite) for host provisioning where users beyond trusted admins hold view_hosts, such as the Viewer role. Those users can call the hosts template API and read rendered provisioning output including the host root password. This is an incomplete fix of CVE-2026-96659; installs where view_hosts is limited to trusted staff can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["api","foreman","high","other","provisioning","satellite","selfhosted"],"campaign_type":null,"search_a":"'-107443':16A,19A '-2026':15A,18A 'api':13A 'cve':14A,17A 'foreman':1A 'host':8A 'level':4A 'password':10A 'read':7A 'root':9A 'templat':12A 'user':5A 'via':11A 'viewer':3A 'viewer-level':2A","search_b":"'api':20B,40B 'authent':29B 'call':36B 'data':55B 'foreman':21B 'host':27B,33B,38B,48B,59B 'includ':53B 'output':51B 'password':61B 'privileg':34B 'provis':23B,44B 'render':43B,50B 'retriev':42B 'root':60B 'satellit':24B 'self':26B 'self-host':25B 'sensit':54B 'templat':39B,45B 'user':30B 'view':32B","search_c":"'-2026':106C '-96659':107C 'api':88C,118C 'authent':69C 'author':124C 'content':80C 'cve':105C 'data':92C 'disclos':90C 'endpoint':89C 'fix':103C 'flaw':63C 'foreman':67C 'found':65C 'harden':109C 'host':73C,83C,86C,96C,120C 'host-templ':119C 'incomplet':102C 'left':116C 'level':128C 'password':98C 'path':114C,123C 'preview':113C 'privileg':74C 'provis':78C 'render':77C,122C 'retriev':76C 'root':97C 'sensit':91C 'templat':79C,87C,121C 'ui':112C 'user':70C,129C 'via':84C 'view':72C 'viewer':127C 'viewer-level':126C 'web':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107443","severity":null,"published_at":"2026-11-12T20:18:15+00:00","modified_at":"2026-11-12T20:18:15+00:00","first_seen_at":"2026-11-12T20:40:22+00:00","fetched_at":"2026-11-12T20:40:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107443:3781","url":"https://access.redhat.com/security/cve/CVE-2026-107443","severity":null,"published_at":"2026-11-12T20:44:56+00:00","modified_at":"2026-11-12T20:44:56+00:00","first_seen_at":"2026-11-12T20:44:56+00:00","fetched_at":"2026-11-12T20:44:56+00:00","note":"Red Hat CNA page gives description, mitigation, CVSS 7.7. No Foreman security-page entry, affected range or fixed version found yet for 107443 (CVE-2026-96659 fix in 3.19.2/5.0.1 covers only UI preview). Fix unknown; revisit when Foreman publishes. Bugzilla 2547760.","cites":["https://access.redhat.com/security/cve/CVE-2026-107443","https://www.openwall.com/lists/oss-security/2026/10/07/1"]}],"documents":[{"id":138443,"url":"https://access.redhat.com/security/cve/CVE-2026-107443","title":"CVE-2026-107443 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":138444,"url":"https://www.openwall.com/lists/oss-security/2026/10/07/1","title":"oss-security: CVE-2026-96659 Foreman (fixed in 3.19.2, 5.0.1)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}