---
id: "CVE-2026-86324"
page: "https://infrastack.ai/live/CVE-2026-86324"
kind: "vulnerability"
aliases: ["CVE-2026-86324"]
title: "Foreman: SSH key controller lets a user add keys to other accounts"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["foreman", "infrastructure", "provisioning", "self-hosted", "ssh"]
not_affected_if: ["no-create-ssh-keys-permission-grants", "single-admin"]
published_at: "2026-11-12T21:17:33+00:00"
first_seen_at: "2026-11-12T21:40:31+00:00"
updated_at: "2026-11-12T21:42:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86324", "first_seen_at": "2026-11-12T21:40:31+00:00"}]
exploit_sources: []
---

# Foreman: SSH key controller lets a user add keys to other accounts

Link for people: https://infrastack.ai/live/CVE-2026-86324 (this .md is for agents)

Foreman's SSH keys API does not check that the caller may act on the target user, so an attacker with the create_ssh_keys permission can post a public key into another user's account. That key is then pushed to hosts provisioned by the victim, which can give the attacker SSH access to those hosts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Foreman version (`foreman --version` or the Foreman web footer) against the affected range in the sources.
- Review which users hold the create_ssh_keys permission.
- Look for unexpected public keys in users' SSH key lists in Foreman.

## Timeline

- 2026-11-12T21:40:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86324

## From the sources

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_