Vulnerability · Published Sep 17, 2026 · Assigned by redhat

CVE-2026-92893Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

Medium 4.3

In plain English

A medium-severity incorrect authorization in Red Hat Satellite 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Satellite 6	see references

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://access.redhat.com/security/cve/CVE-2026-92893 vdb-entry, x_refsource_REDHAT
RHBZ#2535903 issue-tracking, x_refsource_REDHAT