Red HatCVE-2026-5135
Red Hat Satellite 6: improper access control
Medium6.5CVE-2026-5135 · Published Jul 1, 2026 · updated Jul 9, 2026
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Satellite 6 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-639
- www.cve.org/CVERecord?id=CVE-2026-5135
- nvd.nist.gov/vuln/detail/CVE-2026-5135
- access.redhat.com/errata/RHSA-2026:34365
- access.redhat.com/errata/RHSA-2026:34366
- access.redhat.com/errata/RHSA-2026:34367
- access.redhat.com/errata/RHSA-2026:34368
- access.redhat.com/security/cve/CVE-2026-5135
- bugzilla.redhat.com/show_bug.cgi?id=2452230
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 1 | Red Hat Satellite 6: information disclosure | Medium4.3 | No fix yet |
| Jul 1 | Red Hat Satellite 6: information disclosure | Medium6.5 | No fix yet |
| Jul 1 | Red Hat Enterprise Linux: null pointer dereference | Medium6.5 | No fix yet |
| Jul 1 | Red Hat Enterprise Linux: resource exhaustion | Medium5.5 | No fix yet |
| Jul 1 | Red Hat Feast Feature Server: denial of service | Critical9.1 | 0.59.0 |
| Jul 1 | Red Hat Satellite 6: privilege escalation | High8.8 | No fix yet |