Foreman: Personal Access Token Authorization Bypass (CVE-2026-86322)
Foreman contains an authorization bypass vulnerability in the PersonalAccessTokensController that allows an attacker to create tokens on behalf of other users, leading to full account takeover.
CVE search metadata
CVE search record: CVE-2026-86322. Severity: high. CVSS: 8.8. KEV: no. Product: Foreman. Brief: Foreman: Personal Access Token Authorization Bypass (CVE-2026-86322). Brief link: https://feed.craftedsignal.io/briefs/2026-11-foreman-auth-bypass-cve-2026-86322/
Triage facts
Revision 1- Applicability
- Foreman
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 22:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A flaw exists in the Foreman Api::V2::PersonalAccessTokensController where the UserAware#find_user method fails to verify if the requesting user has the authority to act on behalf of the target user defined in the user_id parameter. An attacker with existing 'create_personal_access_tokens' permissions can send a crafted POST request to create a token for any user, including administrators. The application returns the plaintext token, which the attacker can then use for unauthorized authentication.
Impact
Successful exploitation allows an attacker to impersonate any user within the Foreman instance, including administrative accounts, resulting in full unauthorized access to the platform and associated infrastructure managed by Foreman.
Recommendation
- Identify and audit the use of personal access tokens in the environment.
- Immediately upgrade all instances of Foreman to the latest version that includes the fix for CVE-2026-86322.
- Review audit logs for suspicious activity involving the Api::V2::PersonalAccessTokensController endpoint.
Immediate actions
Audit access logs for excessive POST requests to /api/v2/users/*/personal_access_tokens
Threat Hunt
Monitor web server access logs for API calls to the personal access token endpoint with varying user_id values from a single source account.
Data: Web server access logs, Application audit logs