{"id":"CVE-2026-96659","published":"2026-10-01T17:17:35Z","modified":"2026-10-16T13:33:44Z","title":"A flaw was found in Foreman","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","tier":"core","eol":null,"description":{"text":"A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in Foreman, as shipped in Red Hat Satellite 6.16 for RHEL 8, lets authenticated users reach template preview endpoints that disclose sensitive data such as host root passwords. An attacker needs only low-privilege Viewer credentials and network access to the endpoints, with no user interaction required; where Safemode protections are disabled by insecure configuration, the same flaw may also allow arbitrary command execution as the Foreman system account.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:54Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.00347,"percentile":0.28251,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"Known_Cve | Oct 10, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac903591ff588ac9423f235","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac7b19da11e545ded10ae9b","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac65e541c36819c31053833","created":"2026-10-07"},{"name":"Known_Cve | Oct 7, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac50f7dfc0547b9e8e2e5df","created":"2026-10-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-267","name":"Privilege Defined With Unsafe Actions"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536844","tags":["Issue Tracking","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/1","tags":["Mailing List","Patch","Third Party Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-90920","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90920","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96659","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.65,"detail":"percentile 0.2825"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}