CVE-2026-92893

Name of the Vulnerable Software and Affected Versions foreman ansible plugin (affected versions not specified)

Description A flaw exists in the Ansible inventory API of the foreman ansible plugin. The controller utilizes an unscoped Host.where() call to build host queries, which fails to enforce the search filter linked to the caller's view hosts permission. Consequently, an authenticated user with restricted host visibility can provide arbitrary host IDs within their organization to retrieve the complete Ansible inventory for those hosts, including parameter values that are marked as hidden.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.