# CVE-2026-107443: Foreman API missing authorization in host provisioning template render

Source: https://junglewise.ai/threats/cve-2026-107443-a-flaw-was-found-in-foreman-an-authenticated-user-with-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-107443 · Severity: high · CVSS 7.7 · Published 2026-11-12

Foreman is an infrastructure management platform that provisions and configures host systems. An authenticated user with minimal view-hosts permissions can retrieve rendered provisioning templates via the API, exposing sensitive data like host root passwords. This bypasses an incomplete earlier security fix that only hardened the web UI.

## Quick answers

**Is CVE-2026-107443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107443 being exploited in the wild.

**How severe is CVE-2026-107443?** High severity, with a CVSS score of 7.7, published 12 November 2026.

**Which products and versions are affected?** Foreman.

**Is there a fix for CVE-2026-107443?** No fixed version is recorded yet. Until a fix is deployed, remove view_hosts from untrusted users or block/restrict access to GET /api/v2/hosts/:id/template/:kind. Rotate host root credentials if Viewer-role users may have accessed this endpoint.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-12"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107443 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107443?** Check whether you run Foreman. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Until a fix is deployed, remove view_hosts from untrusted users or block/restrict access to GET /api/v2/hosts/:id/template/:kind. Rotate host root credentials if Viewer-role users may have accessed this endpoint.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-12"}]

## Technical details

A missing authorization check in the API host-template render endpoint (GET /api/v2/hosts/:id/template/:kind) allows view_hosts-privileged users to access rendered provisioning template content that should be restricted to administrators. The vulnerability results from an incomplete fix to CVE-2026-96659, which hardened the web UI preview path but left the API path inadequately authorized. Attackers can retrieve credentials and other secrets embedded in rendered host provisioning output without elevated privileges.

## Affected products

- Foreman

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-107443](https://access.redhat.com/security/cve/CVE-2026-107443)

## Related threats

- [Foreman API authorization bypass in SSH key controller](https://junglewise.ai/threats/cve-2026-86324-a-flaw-was-found-in-foreman-s-api-v2-sshkeyscontroller-where-the)