Information disclosure in Theforeman Foreman
CVE-2026-9073
A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.
EPSS: 0.002 (11.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Theforeman Foreman
- Red Hat Satellite 6
- Red Hat Satellite 6.18 — versions 1782228427
- Red Hat Satellite 6.19 — versions 1782228692
- Redhat Satellite — versions 6.19
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2026-9073?
- CVE-2026-9073 is a medium-severity vulnerability in Theforeman Foreman, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.2/10. Published 2026-06-23.
- How severe is CVE-2026-9073?
- Medium severity. CVSS v3 base score is 6.2 out of 10.