Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92894

Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction

CVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92894

Published

A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92894

Published

rubygem-foreman_ansible

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rubygem-foreman_ansible",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON