CVE-2021-3589
Missing Authentication for Critical Function in Foreman Ansible
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2021-3589- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2021-3589- Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2022-1555 No score
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
EUVD-2022-1555- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vvff-6wrr-4g7q
Missing Authentication for Critical Function in Foreman Ansible
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
GHSA-vvff-6wrr-4g7q- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVGHSA-vvff-6wrr-4g7q
Missing Authentication for Critical Function in Foreman Ansible
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
GHSA-vvff-6wrr-4g7q- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
foreman_ansibleRubyGems |
before 2.0.0 | 2.0.0 |
foreman_ansibleRubyGems |
before 2.0.0, plus listed versions 0.1.00.1.10.2.10.2.20.3 Show 15 moreShow less1.01.11.21.2.11.3.01.3.11.4.01.4.11.4.21.4.31.4.51.4.61.5.01.5.11.5.2 |
2.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3589 is a high vulnerability (CVSS 8.0) in Theforeman Foreman Ansible, published March 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in foreman_ansible 2.0.0.
References
access.redhat.com/security/cve/CVE-2021-3589
bugzilla.redhat.com/show_bug.cgi?id=1969265
nvd.nist.gov/vuln/detail/CVE-2021-3589
github.com/theforeman/foreman_ansible/commit/a5e0827bc3ec6c8ab82f968907857a15646305d5