Executive brief
Red Hat Satellite includes a plugin for Ansible inventory management that failed to properly enforce access restrictions on host data. An authenticated user with limited visibility permissions can bypass those restrictions and retrieve inventory information for hosts they should not see, including sensitive parameters marked as hidden by administrators. This could expose credentials and other confidential configuration data used in automation.
Technical details
The vulnerability is an incorrect authorization / access control bypass (CWE-863) in the foreman_ansible plugin's Ansible inventory API controller. The controller builds host queries using an unscoped Host.where() call that enforces taxonomy-layer access control (organization/location) but fails to apply permission filter layers via Host.authorized(:view_hosts). An authenticated user with view_hosts permission can supply arbitrary host IDs within their organization to bypass the filter and receive full Ansible inventory responses, including host parameters marked as hidden and sensitive Ansible variables. No privilege escalation or custom configuration is required; the built-in "Ansible Tower Inventory Reader" role is sufficient. The attacker gains read access to sensitive data including hidden parameters commonly used to store credentials.
Affected products
- Red Hat Satellite unspecified
- Red Hat foreman_ansible unspecified
Timeline
- 2026-09-17: disclosed: CVE published and Red Hat advisory released