CVE-2026-92893
Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters
Description
A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.
INFO
Published Date :
Sept. 17, 2026, 10:28 a.m.
Last Modified :
Sept. 17, 2026, 10:28 a.m.
Remotely Exploit :
Yes !
Source :
redhat
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 53f830b8-0a3f-465b-8143-3b8a9948e749 |
Solution
- Update the foreman_ansible plugin to the latest version.
- Ensure host visibility is restricted by permissions.
- Scope host queries to enforce view_hosts filter.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-92893 vulnerability anywhere in the article.