CVE-2026-79654: Katello Information Disclosure Vulnerability

CVE-2026-79654 Overview

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization can access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This results in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated user accounts, and event timestamps. The weakness is classified as an Authorization Bypass Through User-Controlled Key [CWE-639].

Critical Impact
Cross-organization information disclosure enables authenticated users to enumerate Content View history from tenants they do not administer, exposing operational metadata useful for reconnaissance.

Affected Products

Katello (Foreman plugin for content management)
Red Hat Satellite (downstream product incorporating Katello)
Content View History API endpoint

Discovery Timeline

2026-08-26 - CVE CVE-2026-79654 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79654

Vulnerability Analysis

Katello manages software content lifecycle across organizations in Foreman-based deployments. The Content View History API returns publication and promotion events for a Content View identified by a user-supplied primary key. The endpoint validates that the caller has generic permission to view Content Views but does not verify that the requested Content View belongs to an organization the caller is authorized to access. An authenticated user in Organization A can supply the identifier of a Content View in Organization B and receive its history records. The disclosed data includes version numbers, promotion targets, actor usernames, and timestamps that describe internal release cadence and operator activity across tenants.

Root Cause

The root cause is a missing tenant-scoped authorization check on a user-controlled object identifier. The controller enforces the Content View viewing permission at the role level but does not intersect the requested object with the caller's organization scope. This pattern matches [CWE-639]: Authorization Bypass Through User-Controlled Key, where an object reference supplied by the client is trusted without confirming it belongs to the caller's authorization boundary.

Attack Vector

Exploitation requires an authenticated account with the standard Content View viewer permission in any organization managed by the Katello instance. The attacker issues an HTTP request to the Content View History API endpoint and substitutes the numeric identifier of a Content View owned by a different organization. The response returns lifecycle history for the target object. No user interaction, elevated privileges, or client-side conditions are required beyond a valid session and network reachability to the Katello API.

No verified proof-of-concept code is available. Refer to the Red Hat CVE-2026-79654 Advisory and the GitHub Katello Pull Request #11847 for the upstream fix.

Detection Methods for CVE-2026-79654

Indicators of Compromise

API requests to Content View History endpoints where the target Content View identifier does not belong to any organization associated with the authenticated user's role assignments.
Sequential or enumerated Content View identifier probing from a single session within a short time window.
Unexpected HTTP 200 responses from cross-organization Content View history queries in Katello access logs.

Detection Strategies

Correlate Katello and Foreman audit logs against the authenticated user's organization membership to flag mismatched object access.
Alert on API paths matching /katello/api/content_views/:id/history where the responding record's organization differs from the caller's active organization.
Baseline normal Content View history query volume per user and alert on statistical outliers indicating enumeration behavior.

Monitoring Recommendations

Forward Katello, Foreman, and Apache or Puma access logs to a centralized analytics platform for cross-tenant correlation.
Retain API request bodies and response metadata long enough to reconstruct enumeration attempts across organizations.
Review role assignments quarterly to confirm the Content View viewer permission is scoped to intended organizations only.

How to Mitigate CVE-2026-79654

Immediate Actions Required

Apply the Katello update that includes the fix from GitHub Katello Pull Request #11847 once available in your distribution channel.
Consult the Red Hat CVE-2026-79654 Advisory for Red Hat Satellite errata and apply the vendor-supplied errata.
Audit existing Content View viewer role assignments and remove permissions from accounts that do not require them.

Patch Information

Upstream remediation is tracked in GitHub Katello Pull Request #11847 and Foreman Project Issue #39701. Red Hat Satellite customers should follow the errata referenced in the Red Hat CVE-2026-79654 Advisory. The fix enforces organization-scoped authorization on the Content View History API so that requests for objects outside the caller's organization return an authorization error.

Workarounds

Restrict the Content View viewer role to trusted operators until the patch is applied.
Place the Katello API behind an authenticated reverse proxy that enforces per-organization allow lists on Content View history endpoints.
Increase audit log review cadence for Content View history endpoints during the exposure window.

bash

# Configuration example
# Review Foreman role assignments and identify accounts with Content View viewer permission
hammer user list
hammer role list
hammer filter list --role "Content View Viewer"

# After patching, verify the installed Katello package version
rpm -q katello