Record status Published
Identifier year (not publication year) 2024
Source publication Sep 4, 2024
Source updated Nov 11, 2025
Imported by cveboard Oct 24, 2026
CNA source text (English) Puppet-foreman: an authentication bypass vulnerability exists in foreman
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
puppet-foreman
Vendor Unknown
Product Unknown
Platforms Unknown
Default status unaffected
Package puppet-foreman
Package collection https://github.com/theforeman/puppet-foreman
puppet-foreman · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver 22.0 Unavailable None listed
Red Hat Satellite 6.13 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.13 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.13 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.5.2.8-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.13 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.13 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.13 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.5.2.8-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.14 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.14 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.14 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.7.0.8-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.14 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.14 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.14 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.7.0.8-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.15 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.15 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.15 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.9.3.4-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.15 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.15 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.15 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.9.3.4-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.16 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.16 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.16 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.12.0.1-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.16 for RHEL 8
Vendor Red Hat
Product Red Hat Satellite 6.16 for RHEL 8
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.16 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.12.0.1-1.el8sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.16 for RHEL 9
Vendor Red Hat
Product Red Hat Satellite 6.16 for RHEL 9
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.16 for RHEL 9 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.12.0.1-1.el9sat unaffectedrpm * Unavailable None listed
Red Hat Satellite 6.16 for RHEL 9
Vendor Red Hat
Product Red Hat Satellite 6.16 for RHEL 9
Platforms Unknown
Default status affected
Package foreman-installer
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Satellite 6.16 for RHEL 9 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:3.12.0.1-1.el9sat unaffectedrpm * Unavailable None listed