PT-2026-146030
CVE-2026-107443
·
Published
2026-11-12
·
Updated
2026-11-12
Description by
CVSS 3.1
7.7
HighMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
A flaw was found in Foreman. An authenticated user with view hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.
Found an issue in the description? Have something to add? Feel free to write us 👾