{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92893", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-17T08:57:57.599Z", "datePublished": "2026-09-17T10:28:12.202Z", "dateUpdated": "2026-09-17T12:39:38.178Z"}, "containers": {"cna": {"title": "Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Satellite 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rubygem-foreman_ansible", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:satellite:6"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-92893", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535903", "name": "RHBZ#2535903", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-17T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-863: Incorrect Authorization", "workarounds": [{"lang": "en", "value": "Restrict which users and roles have access to the view_hosts permission covering the ansible_inventories controller actions. If specific users do not need Ansible inventory access, remove the permission mapping from their roles. Review hidden parameter usage: avoid storing high-value credentials in host parameters that would be included in inventory output"}], "timeline": [{"lang": "en", "time": "2026-09-17T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-17T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Arpit Jain, Independent Security Researcher (arpitjain099) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-17T10:28:12.202Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T12:39:18.653134Z", "id": "CVE-2026-92893", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T12:39:38.178Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92893", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T12:39:18.653134Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T12:39:30.879Z"}}], "cna": {"title": "Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters", "credits": [{"lang": "en", "value": "Red Hat would like to thank Arpit Jain, Independent Security Researcher (arpitjain099) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "rubygem-foreman_ansible", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-17T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-17T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-09-17T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-92893", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535903", "name": "RHBZ#2535903", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Restrict which users and roles have access to the view_hosts permission covering the ansible_inventories controller actions. If specific users do not need Ansible inventory access, remove the permission mapping from their roles. Review hidden parameter usage: avoid storing high-value credentials in host parameters that would be included in inventory output"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-17T10:28:12.202Z"}, "x_redhatCweChain": "CWE-863: Incorrect Authorization"}}, "cveMetadata": {"cveId": "CVE-2026-92893", "state": "PUBLISHED", "dateUpdated": "2026-09-17T12:39:38.178Z", "dateReserved": "2026-09-17T08:57:57.599Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-17T10:28:12.202Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "affected", "packageName": "rubygem-foreman_ansible", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden."}], "id": "CVE-2026-92893", "lastModified": "2026-09-18T19:06:08.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92893", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T12:39:18.653134Z", "version": "2.0.3"}}]}, "published": "2026-09-17T11:17:03.337", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-92893"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535903"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Arpit Jain, Independent Security Researcher (arpitjain099) for reporting this issue.", "bugzilla": {"description": "rubygem-foreman_ansible: Ansible inventory API ignores view_hosts permission filters, exposes hidden parameters", "id": "2535903", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535903"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden."], "mitigation": {"lang": "en:us", "value": "Restrict which users and roles have access to the view_hosts permission covering the ansible_inventories controller actions. If specific users do not need Ansible inventory access, remove the permission mapping from their roles. Review hidden parameter usage: avoid storing high-value credentials in host parameters that would be included in inventory output"}, "name": "CVE-2026-92893", "public_date": "2026-09-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92893\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92893"], "statement": "Red Hat Product Security has assessed this issue as a Moderate severity vulnerability. This vulnerability affects the foreman_ansible plugin's Ansible inventory controller, which is shipped in Red Hat Satellite.\nThe Foreman authorization model provides two layers of access control for the view_hosts permission: taxonomy scoping (organization and location), which is enforced by a default scope on the Host model, and permission search filters, which must be applied explicitly by calling Host.authorized(:view_hosts). The inventory controller applies only the taxonomy layer but not the permission filter layer. An attacker with a filtered view_hosts permission can therefore access inventory for hosts outside their filter but within their organizations.\nThe inventory response includes host parameters with their actual values, including parameters flagged as hidden and Ansible variables with the hidden value flag set. While the Foreman documentation notes that the hidden flag is a UI convenience rather than a security boundary, administrators commonly use it for sensitive data. The exposure of these values is what elevates this from a simple filter bypass to a data disclosure issue.\nNo non-default configuration is needed. The built-in \"Ansible Tower Inventory Reader\" role grants the required view_hosts permission, making the vulnerable endpoint accessible without custom role configuration.", "threat_severity": "Moderate"}