{"id":"CVE-2026-86324","kind":"vulnerability","aliases":["CVE-2026-86324"],"related":[],"title":"Foreman: SSH key controller lets a user add keys to other accounts","description":"A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.","summary":"Foreman's SSH keys API does not check that the caller may act on the target user, so an attacker with the create_ssh_keys permission can post a public key into another user's account. That key is then pushed to hosts provisioned by the victim, which can give the attacker SSH access to those hosts.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["foreman","infrastructure","provisioning","self-hosted","ssh"],"not_affected_if":["no-create-ssh-keys-permission-grants","single-admin"],"how_to_check":"- Check the installed Foreman version (`foreman --version` or the Foreman web footer) against the affected range in the sources.\n- Review which users hold the create_ssh_keys permission.\n- Look for unexpected public keys in users' SSH key lists in Foreman.","fix":null,"status":"open","published_at":"2026-11-12T21:17:33+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","triaged_at":"2026-11-12T21:42:25+00:00","updated_at":"2026-11-12T21:42:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T21:42:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Foreman: SSH key controller lets a user add keys to other accounts","impact":"high","summary":"Foreman's SSH keys API does not check that the caller may act on the target user, so an attacker with the create_ssh_keys permission can post a public key into another user's account. That key is then pushed to hosts provisioned by the victim, which can give the attacker SSH access to those hosts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["foreman","self-hosted","ssh","provisioning"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains SSH access to victim's managed hosts","analyst_note":"Confirm affected and fixed Foreman versions from the NVD entry or Foreman advisory; the sources given do not list a fix.","how_to_check":"- Check the installed Foreman version (`foreman --version` or the Foreman web footer) against the affected range in the sources.\n- Review which users hold the create_ssh_keys permission.\n- Look for unexpected public keys in users' SSH key lists in Foreman.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-create-ssh-keys-permission-grants","single-admin"],"who_is_affected":"Teams running Foreman to provision and manage hosts, where some users hold the create_ssh_keys permission. Exposure depends on whether non-admin users can reach the SSH keys API for other users. Installations where only fully trusted administrators can create SSH keys are lower risk. unknown for the exact affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4669,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86324':15A,18A '/api/v2/users':135C 'access':79B,176C 'account':12A,61B,153C 'act':38B 'add':8A 'allow':167C 'anoth':58B,139C 'api':30B,90C 'attack':45B,77B,120C,169C 'authent':171C 'author':117C,130C 'bypass':131C 'caller':36B 'check':33B,118C 'control':4A,101C 'creat':48B,123C 'cve':13A,16A 'enforc':111C 'exploit':128C 'find':103C 'flaw':84C 'foreman':1A,19B,26B,88C,100C 'found':86C 'gain':174C 'give':75B 'host':24B,68B,82B,161C,182C 'id':109C,142C 'id/ssh_keys':137C 'infrastructur':20B 'inject':144C,155C 'key':3A,9A,29B,50B,56B,63B,125C,149C,156C 'let':5A 'manag':181C 'may':37B 'param':107C 'parent':115C 'parent-us':114C 'permiss':51B,126C 'post':53B,134C 'potenti':166C 'propag':159C 'provis':21B,69B,162C 'public':55B,147C 'push':66B 'requir':113C 'resolv':98C 'self':23B 'self-host':22B 'ssh':2A,25B,28B,49B,78B,124C,148C,175C 'sshkeyscontrol':92C 'submit':133C 'subsequ':158C 'target':41B,95C,152C 'use':105C 'user':7A,42B,59B,96C,104C,108C,116C,136C,140C,165C 'user.find':106C 'userawar':102C 'v2':91C 'victim':72B,179C 'without':110C","nicknames":[],"mitigations":[],"who_affected":"Teams running Foreman to provision and manage hosts, where some users hold the create_ssh_keys permission. Exposure depends on whether non-admin users can reach the SSH keys API for other users. Installations where only fully trusted administrators can create SSH keys are lower risk. unknown for the exact affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["foreman","infrastructure","medium","provisioning","selfhosted","ssh"],"campaign_type":null,"search_a":"'-2026':14A,17A '-86324':15A,18A 'account':12A 'add':8A 'control':4A 'cve':13A,16A 'foreman':1A 'key':3A,9A 'let':5A 'ssh':2A 'user':7A","search_b":"'access':79B 'account':61B 'act':38B 'anoth':58B 'api':30B 'attack':45B,77B 'caller':36B 'check':33B 'creat':48B 'foreman':19B,26B 'give':75B 'host':24B,68B,82B 'infrastructur':20B 'key':29B,50B,56B,63B 'may':37B 'permiss':51B 'post':53B 'provis':21B,69B 'public':55B 'push':66B 'self':23B 'self-host':22B 'ssh':25B,28B,49B,78B 'target':41B 'user':42B,59B 'victim':72B","search_c":"'/api/v2/users':135C 'access':176C 'account':153C 'allow':167C 'anoth':139C 'api':90C 'attack':120C,169C 'authent':171C 'author':117C,130C 'bypass':131C 'check':118C 'control':101C 'creat':123C 'enforc':111C 'exploit':128C 'find':103C 'flaw':84C 'foreman':88C,100C 'found':86C 'gain':174C 'host':161C,182C 'id':109C,142C 'id/ssh_keys':137C 'inject':144C,155C 'key':125C,149C,156C 'manag':181C 'param':107C 'parent':115C 'parent-us':114C 'permiss':126C 'post':134C 'potenti':166C 'propag':159C 'provis':162C 'public':147C 'requir':113C 'resolv':98C 'ssh':124C,148C,175C 'sshkeyscontrol':92C 'submit':133C 'subsequ':158C 'target':95C,152C 'use':105C 'user':96C,104C,108C,116C,136C,140C,165C 'user.find':106C 'userawar':102C 'v2':91C 'victim':179C 'without':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T21:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86324","severity":null,"published_at":"2026-11-12T21:17:33+00:00","modified_at":"2026-11-12T21:17:33+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","fetched_at":"2026-11-12T21:40:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}