MEDIUM 4.3 NVD
CVE-2026-92894
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.
References
- https://access.redhat.com/security/cve/CVE-2026-92894
- https://bugzilla.redhat.com/show_bug.cgi?id=2535902
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-09-17 via NVD.
vulnfeed aggregates 12865 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.