Is CVE-2026-107443 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107443 being exploited in the wild.

How severe is CVE-2026-107443?

High severity, with a CVSS score of 7.7, published 12 November 2026.

How is CVE-2026-107443 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107443?

Check whether you run Foreman. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107443: Foreman API missing authorization in host provisioning template render

CVE-2026-107443 · Severity: high · CVSS 7.7 · Published 2026-11-12

Foreman is an infrastructure management platform that provisions and configures host systems. An authenticated user with minimal view-hosts permissions can retrieve rendered provisioning templates via the API, exposing sensitive data like host root passwords. This bypasses an incomplete earlier security fix that only hardened the web UI.

Quick answers

Is CVE-2026-107443 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107443 being exploited in the wild.
How severe is CVE-2026-107443?: High severity, with a CVSS score of 7.7, published 12 November 2026.
Which products and versions are affected?: Foreman.
Is there a fix for CVE-2026-107443?: No fixed version is recorded yet. Until a fix is deployed, remove view_hosts from untrusted users or block/restrict access to GET /api/v2/hosts/:id/template/:kind. Rotate host root credentials if Viewer-role users may have accessed this endpoint.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-12"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107443 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107443?: Check whether you run Foreman. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Until a fix is deployed, remove view_hosts from untrusted users or block/restrict access to GET /api/v2/hosts/:id/template/:kind. Rotate host root credentials if Viewer-role users may have accessed this endpoint.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-12"}]

Technical details

A missing authorization check in the API host-template render endpoint (GET /api/v2/hosts/:id/template/:kind) allows view_hosts-privileged users to access rendered provisioning template content that should be restricted to administrators. The vulnerability results from an incomplete fix to CVE-2026-96659, which hardened the web UI preview path but left the API path inadequately authorized. Attackers can retrieve credentials and other secrets embedded in rendered host provisioning output without elevated privileges.

Affected products

Foreman

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.