CVE-2026-5135Patch(redhat / enterprise_linux)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch redhat enterprise_linux systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.

redhat CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_linux
foreman
satellite

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

redhat theforeman

Products

enterprise_linuxforemansatellite

2 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.openwall.com/lists/oss-security/2026/07/07/7

Full discourse1 post

Open Source Security mailing list@oss_security91d
Patch
Foreman: 4 CVEs fixed in 3.18.2, 3.19.1 https://www.openwall.com/lists/oss-security/2026/07/07/7 CVE-2026-5136: Privilege escalation via usergroup role assignment CVE-2026-5142: Private SSH key disclosure CVE-2026-5135: Unauthorized modification of host configuration CVE-2026-5138: Information disclosure
Post summary
Foreman users should update to version 3.18.2 or 3.19.1 to address four CVEs, including privilege escalation, key disclosure, configuration tampering, and information disclosure.
00031523
4.7K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	redhat	enterprise_linux	8.0	-	-
OS	redhat	enterprise_linux	9.0	-	-
App	redhat	satellite	-	-	-
App	theforeman	foreman	-	-	-

Explore more

Back to dashboard redhat CVEs theforeman CVEs enterprise_linux vulnerabilities