CVE-2026-81658
Received Received - Intake

Foreman Template Revision Unauthorized Information Disclosure

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81658
EUVD
EUVD-2026-66996

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat foreman *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81658 is a flaw in Foreman where the template revision endpoint lacks proper authorization checks. An authenticated low-privileged user with limited permissions can access historical template revisions belonging to other organizations or locations by supplying an audit ID. This exposes sensitive data like credentials or configuration secrets.

Detection Guidance

Check Foreman logs for unauthorized access attempts to template revision endpoints. Review audit logs for suspicious audit ID queries. Inspect network traffic for requests to /templates/revision or similar endpoints with unusual parameters.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive information stored in historical template revisions. This could include credentials, configuration details, or other secrets that may compromise system security or lead to further attacks.

Compliance Impact

The unauthorized disclosure of sensitive data, such as credentials or configuration secrets, could violate compliance requirements under GDPR or HIPAA, which mandate protection of personal and health information. This may result in legal penalties or reputational damage.

Mitigation Strategies

Apply the latest Foreman security patches immediately. Restrict template-related permissions to only necessary users. Monitor and audit all template revision access attempts. Consider disabling the vulnerable endpoint if not critical until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart