CVE-2026-92894
Last modified
CVE-2026-92894 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit.
Description
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Satellite 6 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-92894?
How severe is CVE-2026-92894?
How do I fix CVE-2026-92894?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9284The WooCommerce PayPal Payments plugin for WordPress is vuln…8.2
- CVE-2026-92860A security flaw has been discovered in rcourtman Pulse up to…9.1
- CVE-2026-92879A security flaw has been discovered in vgmstream up to r2117…4.3
- CVE-2026-92880A weakness has been identified in vgmstream up to r2117. Imp…6.3
- CVE-2026-92881A security vulnerability has been detected in vgmstream. The…4.3
- CVE-2026-92893A flaw was found in the foreman_ansible plugin's Ansible inv…4.3
- CVE-2026-9290The WP User Manager – User Profile Builder & Membership plug…7.5
- CVE-2026-92903Improper input validation in Snowflake CLI versions prior to…8.2
- CVE-2026-92904A flaw was found in the foreman_remote_execution plugin's te…4.3
- CVE-2026-9291Insecure deserialization in the job results processing compo…7.5
- CVE-2026-92912AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses…6.5
- CVE-2026-92913AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…7.4
Are you affected by CVE-2026-92894?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST