CVE-2026-92893 Red Hat CVE debrief

Who should care

Defenders and administrators of systems using the foreman_ansible plugin should assess exposure and verify inventory checks for restricted host visibility. This issue affects systems where authenticated users have restricted host visibility and may impact the confidentiality of Ansible inventory data.

Why it matters

CVE-2026-92893 is a MEDIUM severity issue in foreman_ansible plugin's Ansible inventory API that allows authenticated users with restricted host visibility to access full Ansible inventory for arbitrary host IDs, potentially impacting confidentiality of Ansible inventory data. Defenders and administrators should assess exposure, verify inventory checks, and review permission filters.

• Authenticated users with restricted host visibility can access full Ansible inventory for arbitrary host IDs
• Hidden parameter values may be exposed to authenticated users
• Inventory checks and permission filters for view_hosts permission require review and update

Technical summary

The foreman_ansible plugin's Ansible inventory API uses an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. This allows authenticated users with restricted host visibility to supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden. The issue has a CVSS score of 4.3 and is classified as MEDIUM severity. The flaw can be addressed by verifying inventory checks, assessing exposure, and reviewing permission filters for view_hosts permission.

Defensive priority

Assess exposure and verify inventory checks for restricted host visibility

Recommended defensive actions

• Verify inventory checks for restricted host visibility in foreman_ansible plugin
• Assess exposure of Ansible inventory API to authenticated users
• Review and update permission filters for view_hosts permission
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The flaw in foreman_ansible plugin's Ansible inventory API allows authenticated users with restricted host visibility to supply arbitrary host IDs and receive full Ansible inventory for those hosts, including hidden parameter values. This issue has a CVSS score of 4.3 and is classified as MEDIUM severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.