{"id":"CVE-2024-6861","aliases":["EUVD-2024-47859","GHSA-q5h7-2qmh-rxhr","RHSA-2022:8506"],"status":"published","title":"Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api","description":"A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00667,"percentile":0.52195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2024-09-29T19:10:39Z","modified":"2026-10-13T10:03:33Z","affected":[{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-2.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10}],"products":[{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.12 for rhel 8"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2022:8506","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6861","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317450","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2","tags":["article"]},{"url":"https://projects.theforeman.org/issues/34328","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6861","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q5h7-2qmh-rxhr"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1973329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2074346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2093884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103129","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115832","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2133468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139371","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22818","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/feb/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24836","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24836","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24836","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25648","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-GIT-2421270","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29181","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32209","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32209","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34265","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6861","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-6861","title":"Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api","description":"A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.","status":"published","published":"2024-11-06T14:54:51.099Z","modified":"2025-11-20T07:31:26.304Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47859","description":"A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.","status":"published","published":"2024-11-06T14:54:51Z","modified":"2025-11-20T07:31:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:15.042838Z"}],"ghsa":[{"id":"GHSA-q5h7-2qmh-rxhr","title":"A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the...","description":"A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.","status":"published","published":"2024-11-06T15:30:40Z","modified":"2024-11-06T15:30:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:58:44.780147Z"}],"nvd":[{"id":"CVE-2024-6861","description":"A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.","status":"published","published":"2024-11-06T15:15:20.187Z","modified":"2026-06-17T08:18:51.713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:35.864552Z"}],"osv":[{"id":"RHSA-2022:8506","title":"Red Hat Security Advisory: Satellite 6.12 Release","status":"published","published":"2024-09-29T19:10:39Z","modified":"2026-10-13T10:03:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"}]}}