Project and Agile Management

In Foreman and Red Hat Satellite versions from 6.0 up to and including 6.19 a medium severity vulnerability CVE-2026-13316 was detected. This vulnerability allows an attacker to perform a Server-Side Request Forgery (SSRF) attack and extract sensitive information from cloud metadata services in AWS, GCP, and Azure environments. This occurs due to unvalidated test_url parameters within the Foreman configuration, specifically when HTTP parameters are manipulated in the http_proxies_controller and http_proxy files. By exploiting this flaw, an attacker can force the server to make unauthorized requests to internal network endpoints, compromising the cloud infrastructure’s metadata. To address this issue, users should upgrade Red Hat Satellite to a patched version 6.19.x as soon as it is available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13316.

In Foreman versions from 1.9.0 up to 3.19.1, and Red Hat Satellite versions 6.16 before 6.16.4, 6.17 before 6.17.12, 6.18 before 6.18.10, and 6.19 before 6.19.5 a critical severity vulnerability CVE-2026-96659 was detected. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure, potentially escalating to Remote Code Execution (RCE) under certain configurations. This occurs due to excessive permissions granted on template preview endpoints. By submitting crafted requests to these endpoints, an attacker can access sensitive data such as host root passwords. Furthermore, if the system is insecurely configured with Safemode protections disabled, this flaw allows the execution of arbitrary commands as the Foreman system account. To address this issue, users should upgrade Red Hat Satellite to versions 6.16.4, 6.17.12, 6.18.10, 6.19.5, or later, and apply the corresponding patch for Foreman. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-96659.

In affected versions of the Ansible Automation Platform (AAP) gateway a medium severity vulnerability CVE-2026-94416 was detected. This vulnerability allows an authenticated administrator to create a new service key for the Controller service cluster. To address this issue, users should upgrade Ansible to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-94416.

In the foreman_ansible plugin component for Foreman in unpatched versions a medium severity vulnerability CVE-2026-92894 was detected. This vulnerability allows an authenticated attacker to delete arbitrary configuration override values. To address this issue, users should upgrade the foreman_ansible plugin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-92894.

In foreman_ansible plugin component for Foreman in affected versions a medium severity vulnerability CVE-2026-92893 was detected. This vulnerability allows an attacker to bypass host view permissions and access restricted information. To address this issue, users should upgrade Foreman to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-92893.

In Kimai versions prior to 2.58.0 a medium severity vulnerability CVE-2026-52823 was detected. This vulnerability allows an attacker to perform unauthorized actions by tricking an authenticated user into visiting a malicious link. To address this issue, users should upgrade Kimai to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-52823.

In Kimai versions 2.65.0 and earlier a medium severity vulnerability CVE-2026-84804 was detected. This vulnerability allows authenticated users to bypass authorization controls. To address this issue, users should upgrade Kimai to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-84804.

In Kimai versions from 2.61.0 before 2.63.0 a medium severity vulnerability CVE-2026-84805 was detected. This vulnerability allows an authenticated regular user to use the API to modify their own admin-only work-contract data. To address this issue, users should upgrade Kimai to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-84805.

In Foreman versions prior to 6.16.10 a high severity vulnerability CVE-2026-5136 was detected. This vulnerability allows attackers to gain unintended role permissions. To address this issue, users should upgrade Foreman to version 6.16.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5136.