Quick answers
- Is CVE-2026-5135 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-5135 being exploited in the wild.
- How severe is CVE-2026-5135?
- Medium severity, with a CVSS score of 6.5, published 1 July 2026.
- Which products and versions are affected?
- Foreman Foreman; Red Hat Red Hat Satellite 6.
- Is there a fix for CVE-2026-5135?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-5135 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-5135?
- Check whether you run Foreman. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A broken access control vulnerability (CWE-639) exists in Foreman's handling of lookup value overrides. An authenticated attacker with 'edit_hosts' permissions can bypass authorization checks by modifying the 'match' field through nested host attributes. By first creating a legitimate override on a host they control and then retargeting the match field to a victim host's FQDN, the attacker can inject values into the ENC (External Node Classifier) pipeline. This allows for the unauthorized modification of managed host configurations across organizational and location boundaries, provided a lookup key with 'fqdn' in its path exists.
Affected products
- Foreman Foreman
- Red Hat Red Hat Satellite 6
Timeline
- 2026-03-27: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-01: advisory: NVD publication date