CVE-2026-5135
Last modified
CVE-2026-5135 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | >= 6.16, < 6.16.10 |
| Redhat | Satellite | >= 6.17, < 6.17.9 |
| Redhat | Satellite | >= 6.18, < 6.18.7 |
| Redhat | Satellite | >= 6.19, < 6.19.2 |
| Theforeman | Foreman | < 3.18.2 |
| Theforeman | Foreman | >= 3.19.0, < 3.19.1 |
References
- https://access.redhat.com/errata/RHSA-2026:34365Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34366Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34367Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:34368Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-5135Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452230Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5135?
How severe is CVE-2026-5135?
How do I fix CVE-2026-5135?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-51303Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-51304Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2026-5131GREENmod uses named pipes for communication between plugins,…6.9
- CVE-2026-5132Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7…6.5
- CVE-2026-5134Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-51346SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and…9.1
- CVE-2026-5136A flaw was found in Foreman. The Usergroup model in Foreman …8.8
- CVE-2026-51366SQL Injection vulnerability in Bottinelli Informatica Vedo S…9.9
- CVE-2026-51367An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows…7.5
- CVE-2026-51368An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in th…9.8
- CVE-2026-5137The RTMKit (rometheme-for-elementor) plugin for WordPress is…4.3
- CVE-2026-51376An issue in BitChat for iOS v1.15.0 allows a remote attacker…6.5
Are you affected by CVE-2026-5135?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST