CVE-2025-9572: 
NixOS vulnerability analysis and mitigation

CVE-2025-9572 is an authorization bypass vulnerability in Foreman's GraphQL API that allows low-privileged authenticated users to access metadata and sensitive information beyond their assigned permissions. Unlike the REST API, which correctly enforces role-based access controls, the GraphQL endpoint fails to apply proper filtering, resulting in unauthorized information disclosure. The vulnerability affects Foreman versions 1.22.0 through 3.16.1 (fixed in 3.16.2), as well as Red Hat Satellite versions 6.15, 6.16, 6.17, and 6.18 running on RHEL 8/9. It was publicly disclosed on February 27, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Red Hat Advisory).

The root cause is an incorrect authorization implementation (CWE-863) in Foreman's GraphQL API layer, which fails to apply the same permission-based filtering enforced by the REST API, leading to exposure of sensitive information to unauthorized actors (CWE-200). An authenticated low-privileged user can send crafted GraphQL queries to the Foreman GraphQL endpoint and retrieve metadata objects that their role-based permissions should restrict. No special configuration or elevated privileges beyond a valid low-privilege account are required, and no user interaction is needed. The flaw is network-exploitable with low attack complexity (Feedly, Red Hat RHSA-2025:21893).

Successful exploitation results in a confidentiality breach where low-privileged users can access restricted metadata and system information managed by Foreman or Red Hat Satellite — such as host configurations, infrastructure details, and other sensitive operational data — that should be gated by their assigned permissions. There is no impact to integrity or availability. In environments where Foreman or Satellite manages large infrastructure footprints, unauthorized metadata access could facilitate reconnaissance and lateral movement planning by an insider threat or compromised low-privilege account (Feedly, Red Hat RHSA-2025:21897).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.02%, indicating a very low probability of exploitation in the near term. Detection coverage is available via Qualys (detection IDs 6045098–6045101) and Nessus (plugin IDs 276451, 276455, 276639) (Feedly).

1. Obtain low-privilege credentials: Acquire any valid low-privileged Foreman or Red Hat Satellite user account (e.g., a read-only or limited-role account).
2. Identify the GraphQL endpoint: Locate the Foreman GraphQL API endpoint, typically accessible at /api/graphql on the Foreman/Satellite server.
3. Authenticate to the API: Use the low-privilege credentials to authenticate via HTTP Basic Auth or session token against the GraphQL endpoint.
4. Craft GraphQL queries: Construct GraphQL queries targeting resource types (e.g., hosts, domains, subnets, organizations) that the account's role should not have permission to view.
5. Submit queries and retrieve restricted data: Send the crafted queries to the GraphQL endpoint; due to the missing authorization filter, the API returns metadata objects beyond the user's assigned permissions, exposing sensitive infrastructure information (Feedly, Red Hat RHSA-2025:21893).

• Network: Unusual or high-volume GraphQL POST requests to /api/graphql from low-privileged user accounts; queries requesting resource types inconsistent with the user's assigned role.
• Logs: Foreman application logs showing GraphQL queries returning large result sets for accounts with restricted permissions; access log entries for /api/graphql from accounts that do not normally use the GraphQL API.
• Behavioral: A low-privilege account making repeated GraphQL API calls enumerating hosts, domains, subnets, or organizations; discrepancy between REST API access patterns and GraphQL API access patterns for the same user account.

Upgrade Foreman to version 3.16.2 or later to remediate the vulnerability (Foreman Security). Red Hat Satellite users should apply the following version-specific patches released on November 20, 2025: Satellite 6.15 → foreman-3.9.1.14 (RHSA-2025:21897), Satellite 6.16 → foreman-3.12.0.12 (RHSA-2025:21894), Satellite 6.17 → foreman-3.14.0.11 (RHSA-2025:21893), Satellite 6.18 → foreman-3.16.0.7 (RHSA-2025:21886). As an interim workaround prior to patching, implement network-level controls to restrict access to the GraphQL API endpoint to trusted users and IP ranges, or disable GraphQL API access entirely if it is not operationally required (Red Hat RHSA-2025:21886, Red Hat RHSA-2025:21897).

Red Hat rated this vulnerability as "Moderate" severity across all affected Satellite advisories and issued four separate security errata (RHSA-2025:21886, 21893, 21894, 21897) to address the issue across Satellite versions 6.15–6.18 (Red Hat RHSA-2025:21886). The vulnerability was tracked in Red Hat Bugzilla as BZ-2391715 and assigned by Red Hat's security team. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE aggregator coverage.