285 lines
12 KiB
JSON
285 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-86324",
|
||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "redhat",
|
||
"dateReserved": "2026-09-07T06:25:38.505Z",
|
||
"datePublished": "2026-11-12T20:19:57.526Z",
|
||
"dateUpdated": "2026-11-13T16:59:10.191Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller",
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"content": {
|
||
"value": "Moderate",
|
||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||
},
|
||
"type": "Red Hat severity rating"
|
||
}
|
||
},
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "NONE",
|
||
"baseScore": 4.3,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "LOW",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts."
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "Red Hat",
|
||
"product": "Red Hat Satellite 6.16 for RHEL 8",
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"packageName": "foreman",
|
||
"defaultStatus": "affected",
|
||
"versions": [
|
||
{
|
||
"version": "0:3.12.0.26-1.el8sat",
|
||
"lessThan": "*",
|
||
"versionType": "rpm",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"cpes": [
|
||
"cpe:/a:redhat:satellite:6.16::el8",
|
||
"cpe:/a:redhat:satellite:6.16::el9",
|
||
"cpe:/a:redhat:satellite_capsule:6.16::el8",
|
||
"cpe:/a:redhat:satellite_capsule:6.16::el9",
|
||
"cpe:/a:redhat:satellite_utils:6.16::el8",
|
||
"cpe:/a:redhat:satellite_utils:6.16::el9"
|
||
]
|
||
},
|
||
{
|
||
"vendor": "Red Hat",
|
||
"product": "Red Hat Satellite 6.16 for RHEL 9",
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"packageName": "foreman",
|
||
"defaultStatus": "affected",
|
||
"versions": [
|
||
{
|
||
"version": "0:3.12.0.26-1.el9sat",
|
||
"lessThan": "*",
|
||
"versionType": "rpm",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"cpes": [
|
||
"cpe:/a:redhat:satellite:6.16::el8",
|
||
"cpe:/a:redhat:satellite:6.16::el9",
|
||
"cpe:/a:redhat:satellite_capsule:6.16::el8",
|
||
"cpe:/a:redhat:satellite_capsule:6.16::el9",
|
||
"cpe:/a:redhat:satellite_utils:6.16::el8",
|
||
"cpe:/a:redhat:satellite_utils:6.16::el9"
|
||
]
|
||
},
|
||
{
|
||
"vendor": "Red Hat",
|
||
"product": "Red Hat Satellite 6.17 for RHEL 9",
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"packageName": "foreman",
|
||
"defaultStatus": "affected",
|
||
"versions": [
|
||
{
|
||
"version": "0:3.14.0.26-1.el9sat",
|
||
"lessThan": "*",
|
||
"versionType": "rpm",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"cpes": [
|
||
"cpe:/a:redhat:satellite:6.17::el9",
|
||
"cpe:/a:redhat:satellite_capsule:6.17::el9",
|
||
"cpe:/a:redhat:satellite_maintenance:6.17::el9",
|
||
"cpe:/a:redhat:satellite_utils:6.17::el9"
|
||
]
|
||
},
|
||
{
|
||
"vendor": "Red Hat",
|
||
"product": "Red Hat Satellite 6.18 for RHEL 9",
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"packageName": "foreman",
|
||
"defaultStatus": "affected",
|
||
"versions": [
|
||
{
|
||
"version": "0:3.16.0.29-1.el9sat",
|
||
"lessThan": "*",
|
||
"versionType": "rpm",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"cpes": [
|
||
"cpe:/a:redhat:satellite:6.18::el9",
|
||
"cpe:/a:redhat:satellite_capsule:6.18::el9",
|
||
"cpe:/a:redhat:satellite_maintenance:6.18::el9",
|
||
"cpe:/a:redhat:satellite_utils:6.18::el9"
|
||
]
|
||
},
|
||
{
|
||
"vendor": "Red Hat",
|
||
"product": "Red Hat Satellite 6.19 for RHEL 9",
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"packageName": "foreman",
|
||
"defaultStatus": "affected",
|
||
"versions": [
|
||
{
|
||
"version": "0:3.18.0.19-1.el9sat",
|
||
"lessThan": "*",
|
||
"versionType": "rpm",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"cpes": [
|
||
"cpe:/a:redhat:satellite:6.19::el9",
|
||
"cpe:/a:redhat:satellite_capsule:6.19::el9",
|
||
"cpe:/a:redhat:satellite_utils:6.19::el9"
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://access.redhat.com/errata/RHSA-2026:100120",
|
||
"name": "RHSA-2026:100120",
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_refsource_REDHAT"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://access.redhat.com/errata/RHSA-2026:99949",
|
||
"name": "RHSA-2026:99949",
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_refsource_REDHAT"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://access.redhat.com/errata/RHSA-2026:99950",
|
||
"name": "RHSA-2026:99950",
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_refsource_REDHAT"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://access.redhat.com/errata/RHSA-2026:99952",
|
||
"name": "RHSA-2026:99952",
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_refsource_REDHAT"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://access.redhat.com/security/cve/CVE-2026-86324",
|
||
"tags": [
|
||
"vdb-entry",
|
||
"x_refsource_REDHAT"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529291",
|
||
"name": "RHBZ#2529291",
|
||
"tags": [
|
||
"issue-tracking",
|
||
"x_refsource_REDHAT"
|
||
]
|
||
}
|
||
],
|
||
"datePublic": "2026-11-12T18:50:00.000Z",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-639",
|
||
"description": "Authorization Bypass Through User-Controlled Key",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key",
|
||
"timeline": [
|
||
{
|
||
"lang": "en",
|
||
"time": "2026-09-07T06:19:41.591Z",
|
||
"value": "Reported to Red Hat."
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"time": "2026-11-12T18:50:00.000Z",
|
||
"value": "Made public."
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "This issue was discovered by Sandipan Roy (Red Hat) and Tej Rathi (Red Hat)."
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||
"shortName": "redhat",
|
||
"dateUpdated": "2026-11-13T16:59:10.191Z"
|
||
},
|
||
"x_generator": {
|
||
"engine": "cvelib 1.8.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-11-13T15:28:45.651295Z",
|
||
"id": "CVE-2026-86324",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-11-13T16:27:33.326Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |