Medium severity4.4NVD Advisory· Published Jun 30, 2026· Updated Jul 6, 2026

CVE-2026-13316

Description

A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component.

Affected products

Red Hat/Satellite
cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*
Range: >=6.0,<=6.19
Theforeman/Foreman
cpe:2.3:a:theforeman:foreman:-:*:*:*:*:*:*:*
Red Hat/foremanllm-fuzzy

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-13316nvdVendor Advisory
bugzilla.redhat.com/show_bug.cginvdVendor AdvisoryIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.286
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000