CVE-2026-9073

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:28405
https://access.redhat.com/errata/RHSA-2026:28438	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-9073	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480151	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:satellite:6.19:::::::*
	cpe:2.3:a:theforeman:foreman:-:::::::*

History

No history.

Information

Published : 2026-06-23 21:17

Updated : 2026-07-15 15:16

NVD link : CVE-2026-9073

Mitre link : CVE-2026-9073

CVE.ORG link : CVE-2026-9073

JSON object : View

Products Affected

redhat

satellite

theforeman

foreman

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-9073", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9073", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T18:20:48.963167Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:satellite:6.18::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.18", "versions": [{"status": "unaffected", "version": "1782228427", "lessThan": "*", "versionType": "rpm"}], "packageName": "satellite/foreman-mcp-server-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.19::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.19", "versions": [{"status": "unaffected", "version": "1782228692", "lessThan": "*", "versionType": "rpm"}], "packageName": "satellite/foreman-mcp-server-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-06-23T21:17:03.440", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:28405", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:28438", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-9073", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480151", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform."}], "lastModified": "2026-07-15T15:16:49.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:6.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCFB23DD-F6A0-4CDB-98E8-E072C104ED4B"}, {"criteria": "cpe:2.3:a:theforeman:foreman:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD7E727C-BF9F-4A86-BCBE-1CE6E1108181"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}