CVE-2024-6861

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

State: Published
Severity: 7.5 High
Published: Nov 6, 2024
Updated: Nov 20, 2025
Reserved: Jul 17, 2024

Description

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
foreman	before 3.3Affected
Red Hat Satellite 6.12 for RHEL 8Red Hat	0:3.3.0.17-1.el8sat and laterNot affected
Red Hat Satellite 6Red Hat
Red Hat Satellite 6Red Hat
Red Hat Satellite 6Red Hat

References

RHSA-2022:8506vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-6861vdb-entry
RHBZ#2317450issue-tracking
https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2
https://projects.theforeman.org/issues/34328

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.