CVE-2026-5142 | Medium | 6.5 | 2026-07-01 | A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure She… |
CVE-2026-5138 | Medium | 4.3 | 2026-07-01 | A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occu… |
CVE-2026-5135 | Medium | 6.5 | 2026-07-01 | A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup va… |
CVE-2026-5136 | High | 8.8 | 2026-07-01 | A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an… |
CVE-2026-13316 | Medium | 4.4 | 2026-06-30 | A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and st… |
CVE-2026-9073 | Medium | 6.2 | 2026-06-23 | A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One… |
CVE-2026-12112 | High | 7.8 | 2026-06-23 | A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrati… |
CVE-2025-9572 | Medium | 5.0 | 2026-02-27 | n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which corr… |
CVE-2024-7700 | Medium | 6.5 | 2024-08-12 | A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page… |
CVE-2023-4886 | Medium | 6.7 | 2023-10-03 | A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and… |
CVE-2022-3874 | High | 8.0 | 2023-09-22 | A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands throu… |
CVE-2023-0462 | High | 8.0 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setti… |
CVE-2023-0118 | Critical | 9.1 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underl… |
CVE-2021-20260 | High | 7.8 | 2022-08-26 | A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permissi… |
CVE-2021-3590 | High | 8.8 | 2022-08-22 | A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The high… |
CVE-2020-10710 | Medium | 4.4 | 2022-08-16 | A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an atta… |
CVE-2021-3456 | High | 7.1 | 2022-03-30 | An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limi… |
CVE-2021-20290 | Medium | 6.1 | 2022-03-25 | An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be… |
CVE-2021-3589 | High | 8.0 | 2022-03-23 | An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through… |
CVE-2021-3584 | High | 7.2 | 2021-12-23 | A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite… |
CVE-2021-20259 | High | 7.8 | 2021-06-07 | A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts p… |
CVE-2021-3469 | Medium | 5.4 | 2021-06-03 | Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-pr… |
CVE-2020-10716 | Medium | 6.5 | 2021-05-27 | A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Sate… |
CVE-2021-3457 | Medium | 6.1 | 2021-05-12 | An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should b… |
CVE-2021-3494 | Medium | 5.9 | 2021-04-26 | A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA… |
CVE-2021-3413 | Medium | 6.3 | 2021-04-08 | A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resour… |
CVE-2014-0241 | Medium | 5.5 | 2019-12-13 | rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable |
CVE-2014-0091 | Medium | 5.3 | 2019-12-11 | Foreman has improper input validation which could lead to partial Denial of Service |
CVE-2013-4120 | High | 7.5 | 2019-12-10 | Katello has a Denial of Service vulnerability in API OAuth authentication |
CVE-2013-0283 | Medium | 5.4 | 2019-12-05 | Katello: Username in Notification page has cross site scripting |
CVE-2013-2101 | Medium | 5.4 | 2019-12-03 | Katello has multiple XSS issues in various entities |
CVE-2019-14825 | Low | 2.7 | 2019-11-25 | A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discov… |
CVE-2014-8183 | High | 7.4 | 2019-08-01 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access… |
CVE-2019-10198 | Medium | 6.5 | 2019-07-31 | An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which perfo… |
CVE-2019-3893 | Medium | 4.9 | 2019-04-09 | In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password… |
CVE-2018-16887 | Medium | 5.4 | 2019-01-13 | A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is abl… |
CVE-2018-14623 | Medium | 4.3 | 2018-12-14 | A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the bac… |
CVE-2018-16861 | High | 7.6 | 2018-12-07 | A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infra… |
CVE-2018-14664 | Medium | 5.4 | 2018-10-12 | A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs ba… |
CVE-2018-14643 | Critical | 9.8 | 2018-09-21 | An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitr… |
CVE-2016-7078 | Medium | 4.3 | 2018-09-10 | foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/loca… |
CVE-2016-7077 | Medium | 4.3 | 2018-09-10 | foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthoriz… |
CVE-2017-2662 | Medium | 4.3 | 2018-08-22 | A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on th… |
CVE-2016-8639 | Medium | 6.1 | 2018-08-01 | It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set… |
CVE-2016-8634 | Medium | 6.1 | 2018-08-01 | A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard… |
CVE-2016-8613 | Medium | 6.4 | 2018-07-31 | A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains H… |
CVE-2016-9595 | High | 7.3 | 2018-07-27 | A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to condu… |
CVE-2017-7535 | Medium | 6.1 | 2018-07-26 | foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign… |
CVE-2017-2672 | Medium | 6.5 | 2018-06-21 | A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able… |
CVE-2016-9593 | Medium | 4.7 | 2018-04-16 | foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view p… |
CVE-2018-1096 | Medium | 6.5 | 2018-04-05 | An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injecti… |
CVE-2018-1097 | High | 8.8 | 2018-04-04 | A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and… |
CVE-2017-2667 | High | 8.1 | 2018-03-12 | Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a r… |
CVE-2017-15100 | Medium | 6.1 | 2017-11-27 | An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button… |
CVE-2014-3531 | Medium | 5.4 | 2017-10-18 | Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the ope… |
CVE-2014-0208 | Medium | 5.4 | 2017-10-16 | Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitr… |
CVE-2015-5246 | High | 8.1 | 2017-10-06 | The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password… |
CVE-2015-5282 | Medium | 6.1 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. |
CVE-2015-5152 | High | 8.1 | 2017-07-17 | Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to o… |
CVE-2017-7505 | High | 8.8 | 2017-05-26 | Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organiz… |
CVE-2016-6320 | Medium | 5.4 | 2016-08-19 | Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject… |
CVE-2016-6319 | Medium | 6.1 | 2016-08-19 | Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows… |
CVE-2016-5390 | Medium | 5.3 | 2016-08-19 | Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network… |
CVE-2016-4995 | Medium | 5.3 | 2016-08-19 | Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users wit… |
CVE-2016-4475 | High | 8.8 | 2016-08-19 | The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organizati… |
CVE-2016-4451 | Medium | 5.0 | 2016-08-19 | The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to by… |
CVE-2016-3728 | High | 8.8 | 2016-05-20 | Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to… |
CVE-2016-2100 | Medium | 5.4 | 2016-05-20 | Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_boo… |
CVE-2015-5233 | Medium | 4.2 | 2016-04-11 | Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports per… |
CVE-2015-7518 | | | 2015-12-17 | Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTM… |
CVE-2015-3235 | | | 2015-08-14 | Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified ve… |
CVE-2015-3155 | | | 2015-08-14 | Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this co… |
CVE-2015-1844 | | | 2015-08-14 | Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API. |
CVE-2015-1816 | | | 2015-08-14 | Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certifi… |
CVE-2014-3653 | | | 2015-07-06 | Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2014-3691 | | | 2015-03-09 | Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attacker… |
CVE-2014-3492 | | | 2014-07-01 | Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbit… |
CVE-2014-3491 | | | 2014-07-01 | Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2014-4507 | | | 2014-06-20 | Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (… |
CVE-2014-0007 | | | 2014-06-20 | The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path param… |
CVE-2014-0192 | | | 2014-05-08 | Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information v… |
CVE-2014-0135 | | | 2014-05-08 | Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain pass… |
CVE-2014-0090 | | | 2014-05-08 | Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie. |
CVE-2013-0210 | | | 2014-05-08 | The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet command… |
CVE-2013-0187 | | | 2014-05-08 | Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request. |
CVE-2013-0174 | | | 2014-05-08 | The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request. |
CVE-2013-0173 | | | 2014-05-08 | Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack. |
CVE-2013-0171 | | | 2014-05-08 | Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API. |
CVE-2012-5477 | | | 2014-05-08 | The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors. |
CVE-2013-2143 | | | 2014-04-17 | The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote auth… |
CVE-2012-5648 | | | 2014-04-04 | Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) app/m… |
CVE-2014-0089 | | | 2014-03-27 | Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary w… |
CVE-2013-4386 | | | 2013-11-20 | Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands v… |
CVE-2013-4182 | | | 2013-09-16 | app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrar… |
CVE-2013-4180 | | | 2013-09-16 | The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption)… |
CVE-2013-2121 | | | 2013-07-31 | Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to… |
CVE-2013-2113 | | | 2013-07-31 | The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other… |
CVE-2012-3503 | Critical | 9.8 | 2012-08-25 | The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation… |