CVE-2026-5135
Last modified
CVE-2026-5135 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | >= 6.16, < 6.16.10 |
| Redhat | Satellite | >= 6.17, < 6.17.9 |
| Redhat | Satellite | >= 6.18, < 6.18.7 |
| Redhat | Satellite | >= 6.19, < 6.19.2 |
| Theforeman | Foreman | < 3.18.2 |
| Theforeman | Foreman | >= 3.19.0, < 3.19.1 |
References
- https://access.redhat.com/errata/RHSA-2026:34365Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34366Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34367Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34368Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5135Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452230Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5135?
How severe is CVE-2026-5135?
How do I fix CVE-2026-5135?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-51301Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51302Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51303Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51304Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-5131GREENmod uses named pipes for communication between plugins,…6.9
- CVE-2026-5134Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-5136A flaw was found in Foreman. The Usergroup model in Foreman …8.8
- CVE-2026-5137The RTMKit (rometheme-for-elementor) plugin for WordPress is…4.3
- CVE-2026-5138A flaw was found in Foreman. An authenticated user with host…4.3
- CVE-2026-51380Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03…9.8
- CVE-2026-51385An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through …6.9
- CVE-2026-51386Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
Are you affected by CVE-2026-5135?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST