Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-17T00:00:00 rubygem-foreman_ansible: Ansible inventory API ignores view_hosts permission filters, exposes hidden parameters 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-863

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.

Red Hat Product Security has assessed this issue as a Moderate severity vulnerability. This vulnerability affects the foreman_ansible plugin's Ansible inventory controller, which is shipped in Red Hat Satellite. The Foreman authorization model provides two layers of access control for the view_hosts permission: taxonomy scoping (organization and location), which is enforced by a default scope on the Host model, and permission search filters, which must be applied explicitly by calling Host.authorized(:view_hosts). The inventory controller applies only the taxonomy layer but not the permission filter layer. An attacker with a filtered view_hosts permission can therefore access inventory for hosts outside their filter but within their organizations. The inventory response includes host parameters with their actual values, including parameters flagged as hidden and Ansible variables with the hidden value flag set. While the Foreman documentation notes that the hidden flag is a UI convenience rather than a security boundary, administrators commonly use it for sensitive data. The exposure of these values is what elevates this from a simple filter bypass to a data disclosure issue. No non-default configuration is needed. The built-in "Ansible Tower Inventory Reader" role grants the required view_hosts permission, making the vulnerable endpoint accessible without custom role configuration. Red Hat would like to thank Arpit Jain, Independent Security Researcher (arpitjain099) for reporting this issue. Restrict which users and roles have access to the view_hosts permission covering the ansible_inventories controller actions. If specific users do not need Ansible inventory access, remove the permission mapping from their roles. Review hidden parameter usage: avoid storing high-value credentials in host parameters that would be included in inventory output Red Hat Satellite 6 Affected rubygem-foreman_ansible https://www.cve.org/CVERecord?id=CVE-2026-92893 https://nvd.nist.gov/vuln/detail/CVE-2026-92893