CVE-2026-92904 in Satellite
Summary
by MITRE • 09/17/2026
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the foreman_remote_execution plugin represents a critical failure in access control logic, specifically manifesting as an insecure direct object reference combined with insufficient authorization checks on sensitive data retrieval endpoints. The core technical flaw resides within the show_template_invocation_by_host action of the controller responsible for managing job invocations. When this endpoint is invoked to display details about a specific remote execution task, it relies solely on the unique identifier provided in the request payload to locate and retrieve the corresponding record from the database or application state. Crucially, the implementation fails to validate whether the authenticated user making the request possesses the necessary view_job_invocations permission filter for that particular resource instance. This oversight means that the system trusts the object ID supplied by the client without cross-referencing it against the caller's role-based access control policies or organizational boundaries defined in their permissions profile.
From an operational perspective, this flaw allows authenticated users to perform unauthorized enumeration and data exfiltration within their own organization. An attacker who has valid credentials can systematically iterate through sequential job invocation IDs to discover active or historical remote execution tasks belonging to other colleagues. Once a target ID is identified, the vulnerability enables the retrieval of highly sensitive information associated with those jobs. This includes live output streams from running commands, which may contain real-time system diagnostics or error messages revealing internal infrastructure details; rendered scripts that expose proprietary automation logic or configuration management code; and input values submitted during job execution, which frequently contain credentials, API keys, IP addresses, or other confidential parameters intended for secure processing only.
The security implications of this vulnerability are severe as it facilitates both information disclosure and potential lateral movement within the managed infrastructure. By accessing live output and input data from other users' jobs, an attacker can gather intelligence about network topology, software versions, and administrative procedures used by system administrators or DevOps engineers. This contextual information significantly lowers the barrier for subsequent attacks such as privilege escalation or targeted exploitation of known vulnerabilities in specific services identified through the exposed logs. Furthermore, the exposure of input values poses a direct risk to credential hygiene if secrets were passed directly into remote execution commands rather than via secure vaults or environment variables managed by the platform's security features.
This issue aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site, although in this context it is more accurately classified under CWE-862 Missing Authorization as the system fails to enforce access control rules before granting data visibility. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if session tokens were inadvertently exposed in logs, though primarily it falls under information gathering phases like T1046 Network Service Discovery or T1213 Data from Information Repositories. The vulnerability highlights a common pitfall where developers assume that the presence of an ID implies ownership by the requester, neglecting to implement proper object-level permission checks that verify if the current user's role permits viewing the specific resource identified by that ID.
To mitigate this risk, immediate remediation should focus on updating the foreman_remote_execution plugin to enforce strict authorization checks within the show_template_invocation_by_host action. The code must be modified to retrieve the job invocation record first and then explicitly verify if the current user's permissions include view_job_invocations for that specific organization or host group before returning any data. Implementing a deny-by-default approach where access is granted only after explicit validation of role-based filters will prevent unauthorized enumeration. Additionally, organizations should audit their remote execution configurations to ensure sensitive inputs are not passed directly in command lines but instead utilize secure variable injection mechanisms provided by the platform. Regular security code reviews focusing on authorization logic for all API endpoints and controller actions involving user-specific data are essential to prevent similar access control bypasses in future development cycles.