CVE-2026-86324: Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller
Red Hat · Red Hat Satellite 6.16 for RHEL 8
Vendor fix available · Affected: Red Hat Satellite 6.16 for RHEL 8 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
DescriptionNVD
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 13 Nov.
- Red Hat fixes critical sandbox bypass in SatelliteSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.