Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92904

Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

CVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92904

Published

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92904

Published

rubygem-foreman_remote_execution

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rubygem-foreman_remote_execution",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON