CVE-2026-92894

Name of the Vulnerable Software and Affected Versions foreman ansible plugin (affected versions not specified)

Description A flaw exists in the Ansible override values API of the foreman ansible plugin. The destroy action resolves the target LookupValue record by ID but fails to verify if the record belongs to an AnsibleVariable that the caller is authorized to edit. Consequently, an authenticated user possessing the edit ansible variables permission can delete any LookupValue by ID. This includes override values for Ansible variables outside their permission filter scope and override values associated with Puppet smart class parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.