# Red Hat Satellite Foreman template preview authorization flaw (CVE-2026-96659) enables root password theft and code execution

> An authorization weakness (CWE-267) in Foreman template preview endpoints, used by Red Hat Satellite 6.16, 6.18 and 6.19, lets a low-privileged Viewer-role user with network access read admin-only data such as host root passwords, and potentially execute code as the foreman service account when Safemode protections are disabled. A related Safemode sandbox bypass leading to RCE is tracked as CVE-2026-96658 (CVSS 9.9). Patches were released and the flaw disclosed on 2026-10-01; no active exploitation or public PoC is reported.

- **Published:** 2026-10-03T00:00:00Z
- **Last reviewed:** 2026-10-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2874
- **ID:** TL-2026-2874
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96659, CVE-2026-96658, CVE-2023-0118

## Description

CVE-2026-96659 is a flaw in Foreman, the provisioning and lifecycle component embedded in Red Hat Satellite. Red Hat describes it as excessive permissions granted to Viewer-role users on certain API endpoints, notably the template preview endpoint (/template/preview). An authenticated user holding only the low-privileged Viewer role can submit crafted requests to the template preview functionality and retrieve data that should be admin-only, including host root passwords. The weakness is classified as CWE-267 (Privilege Defined With Unsafe Actions; NVD labels it Improper Privilege Management). Red Hat scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L = 9.1 (Red Hat product security rating: Important; NVD: Critical). Exploitation needs network access to the Satellite web/API interface and a valid Viewer account; no user interaction is required.

If Safemode protections for Foreman templates are disabled or bypassed, the same exposure can escalate to arbitrary command execution as the foreman system account. The Safemode bypass is tracked separately as CVE-2026-96658: an authenticated low-privileged attacker can achieve remote code execution by bypassing the safemode sandbox in the Foreman templating engine through improper handling of delegated methods (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9, Red Hat Bugzilla 2534185). The Foreman templating sandbox has a history of such bypasses (for example CVE-2023-0118, an admin-user safe-mode bypass to OS code execution), so the two CVEs should be treated as a chained risk: credential disclosure plus a code-execution path on the provisioning server.

Impact is high because Satellite manages patching, provisioning and configuration for large RHEL fleets; exposed root passwords of managed hosts and code execution as the foreman account on the Satellite server can support lateral movement across the managed estate. Red Hat reported the issue on 2026-09-17 and shipped fixes on 2026-10-01. Fixed Foreman 3.12.0.23-1 is delivered via Satellite 6.16.14 (RHSA-2026:74506, RHEL 8 and 9); Satellite 6.18 is covered by RHSA-2026:74504 and 6.19 by RHSA-2026:74503 (RHEL 9). Red Hat's Bugzilla entry also lists Satellite 6.17 with RHSA-2026:74505, and NVD references all four advisories. The sources do not report in-the-wild exploitation, a public proof of concept, CISA KEV listing, attribution, or network IOCs. Recommended mitigations: apply the errata immediately, remove unnecessary Viewer-role accounts, verify Safemode remains enabled, and monitor template preview requests for abuse.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1059.004 Unix Shell

## Sources

- [Critical Red Hat Satellite Flaw Could Enable Root Password Theft and Code Execution Attacks](https://cybersecuritynews.com/red-hat-satellite-vulnerability/)
- [Red Hat CVE-2026-96659](https://access.redhat.com/security/cve/CVE-2026-96659)
- [Red Hat CVE-2026-96658](https://access.redhat.com/security/cve/CVE-2026-96658)
- [NVD CVE-2026-96659](https://nvd.nist.gov/vuln/detail/CVE-2026-96659)
- [Red Hat Bugzilla 2536844 (CVE-2026-96659)](https://bugzilla.redhat.com/show_bug.cgi?id=2536844)
- [Red Hat Bugzilla 2534185 (CVE-2026-96658)](https://bugzilla.redhat.com/show_bug.cgi?id=2534185)
- [RHSA-2026:74506 Satellite 6.16.14 Async Update](https://access.redhat.com/errata/RHSA-2026:74506)
- [RHSA-2026:74504 Satellite 6.18](https://access.redhat.com/errata/RHSA-2026:74504)
- [RHSA-2026:74503 Satellite 6.19](https://access.redhat.com/errata/RHSA-2026:74503)
- [CVE-2023-0118: Foreman arbitrary code execution through templates (precedent)](https://osv.dev/vulnerability/CVE-2023-0118)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2874