CVE-2026-5142 Red Hat CVE debrief

Who should care

Users of Red Hat Satellite and Foreman, especially those in multi-tenant environments, should be aware of this vulnerability. Applying patches or mitigations provided by Red Hat is crucial to prevent unauthorized access to sensitive information. System administrators and security teams responsible for managing these systems should prioritize patching and review user permissions to ensure least privilege access.

Technical summary

The vulnerability arises from inadequate taxonomy scoping in Foreman, which is used by Red Hat Satellite. Authenticated users with the 'view_keypairs' permission can exploit this flaw to access private SSH keys from other organizations. This is achieved by directly querying key pair IDs, bypassing intended access controls. The vulnerability has a CVSS score of 6.5 and is classified as CWE-639. Affected product deployments should be reviewed for exposure, and patches or updates provided by Red Hat should be applied to address the vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Apply patches or updates provided by Red Hat to address the vulnerability
• Restrict access to sensitive information and SSH keys
• Monitor for suspicious activity related to key pair queries
• Implement additional access controls and scoping to prevent similar bypasses
• Review and update user permissions to ensure least privilege access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record was published on 2026-07-01T15:17:11.977Z and was last modified on 2026-07-09T02:38:36.480Z. The NVD entry is currently Analyzed. Vendor advisories and issue tracking information are available through provided links. The vulnerability affects Red Hat Satellite and Foreman, with a CVSS score of 6.5 and CWE-639 classification.

Official resources