theforeman / foreman

70%

develop: 69%

LAST BUILD ON BRANCH cve-2026-5135/develop

branch: cve-2026-5135/develop

CHANGE BRANCH

x

Reset

• cve-2026-5135/develop
• 1.18-stable
• 1.18.0
• 1.18.0-RC1
• 1.18.0-RC3
• 1.18.2
• 1.18.3
• 1.19-stable
• 1.19.0-RC2
• 1.20-stable
• 1.21-stable
• 1.22-stable
• 1.23-stable
• 1.24-stable
• 2.0-stable
• 2.1-stable
• 2.1.0
• 27457
• 28148
• 29347_new_hosts_page
• 3.14-datatables
• 3.15-stable-build-host-pf5
• 3.16-stable-host-kebab
• 3.16-stable-host-setting-error
• 3.17-stable
• 3.17-stable-cp-38913
• 3.18-dockerbuild
• 3.18-stable-header-css
• 3.18/tax
• 3.18/test
• 31027_host_collection
• 31029_disassociate_hosts
• 31030_change_org_loc
• 31030_org_loc_change
• 32652_purge_puppet_missing_permission
• 33418_typo
• 35779-fix-snapshot-generation
• 35779-simple
• 36200-audit_lists
• 36330_host_overall_status
• 36330_icon_hover
• 37091_scrollbar_change_org
• 37653
• 37789
• 37821
• 37836_reg_cmd_proxy
• 38091_view_hosts_permission
• 38108
• 38115-drop-ruby-2.7-nodejs-14
• 38125-drop-nodejs-14
• 38185_dropdown_card_template
• 38242-replace_ClipboardCopy_with_pf5
• 38244-replace_ToastNotification_with_Alert_pf5
• 38249-update_EditorModal_to_pf5
• 38255-update_setting_page_table_to_pf5
• 38256-update_impersonateIcon_to_pf5
• 38257-update_externalLogout_to_pf5
• 38289-3.14-cp
• 38289-CardTemplate-ouidId-customizing
• 38333-boxes-not-checks
• 38344-LoginPage_update
• 38345-notifications
• 38352-editor_settings_popover
• 38360_new_hosts_ram_column
• 38382-table-index-page-improvements
• 38427_export_hosts
• 38464-docLink
• 38469-http-proxy-test-connection-explanation
• 38475-bookmark_form
• 38538_change_owner_menu
• 38598
• 38606-fix_settings_ui
• 38614
• 38708-slow_settings_page
• 38713-rss-ipv6-literal
• 38732-debian-fwsetup
• 38742
• 38744
• 38761-manage-columns-max-height
• 38762-reg-port-80-fail
• 38799-foreman-context-extend
• 38827-hostgroup-dropdown-hierarchy
• 38840-add-smart-proxy-filters-idle-timeout
• 38846-drop-unused-available_vnic_profiles.rabl
• 38858-fix-hosts-search-pagination-bug
• 38872-add-hardware-model-to-report
• 38884-cssColorsVariables
• 38888-add-cloud-billing-details-card
• 38918-https-rhsm-url-foreman
• 38932-allow-purging-audit-templates
• 38936-fix-kebab-menu
• 38948-add-power-state-bulk-actions
• 38986-runtime-proc-evaluation
• 39002-fix-groupparameter-nil-hostgroup
• 39016-fix-table-row-keys
• 39079_pre_check_default_columns
• 39083-action-cable-notifications
• 39137_typescript
• 39181-manage_notifications_bulk_action
• 39293-add-ks-pre-install-snippet
• 39321-enhancement
• 39326
• 39340
• 39416_popover_css
• 39437_apply_taxononies_to_ui_bulk_actions
• 42765_host_redirect_pkg_details
• 44457_ai_review_skill
• AAhezI
• CVE-2025-9572
• CVE-2025-9572-3.17
• SAT-28295
• SAT-38571
• SAT-38571-refs
• SAT-38761
• SAT-38950
• SAT-41188-new
• SAT_36403
• Update-customCreateActions-function
• access
• add-host-backlink-to-interface-object
• add-insightsreport
• add-packit-commit-trigger
• add-plugin-test-script
• add-scalprum
• add-stylelint
• add-virtual-column
• add-workflow-permissions
• add_os_logo
• add_profiling_extensions
• add_rtl_helper
• areAllRowsOnPageSelected
• areachart
• autocomplete
• autocomplete-scope
• autocompleteInput_move
• banner-height-to-notifications
• barchart
• batch-subtrees
• bond-fix
• bug-38819-ghost-users-are-scary
• bug-39025-hide-taxo-from-taxo
• bug-39099-fix-keywords-for-encode
• bug-39233-broken-apipie-dsl
• bug-39311-fix-autocomplete
• build-host-pf5
• bulk-owner
• buttonsUpdate
• center-power-status-icon-all-hosts
• cherry-pick/38667
• cherry-pick/38715
• cloud-init-use-proper-modules
• cloud-report
• comp_wrapper_test
• compact-tables
• config-report-webhook
• console_user_reload
• core-plugins-test-config
• correct-httpboot-proxy
• cp_10794
• cron-rake-tasks
• css-imports
• css-override-ul
• ct_miau
• custom_table_pagination
• cve-2026-5135/3.18-stable
• cve-2026-5135/3.19-stable
• cve-2026-5136/3.18-stable
• cve-2026-5136/3.19-stable
• cve-2026-5136/develop
• cve-2026-5138/3.18-stable
• cve-2026-5138/3.19-stable
• cve-2026-5138/develop
• cve-2026-5142/3.18-stable
• cve-2026-5142/3.19-stable
• cve-2026-5142/develop
• datatables-pagination
• depreacte-select-pf3
• deprecate-pf3-table
• deprecate-searchInput
• deprecateButtons
• deprecateForemanForm
• deprecateFormField
• deprecate_DateTime
• deprecate_ForemanModal
• deprecate_RadioButtonGroup
• deprecate_TextField
• deprecate_formsForm
• deprecate_formsMultiple
• dev-docs-pf3
• develop
• diff-5.2.2
• diffModal
• doc-update
• docs
• docs-link-url
• donut_chart
• drop-nodejs18
• drop-sendmail
• dualnil
• dynflow-notrunc
• dynflow_ignore_tables
• el10snapshots
• email_asterisk
• emptystate
• evgeni-silly-test
• feat-38024-allow-virt-ordering
• feat-38328-show-upgrade-docs-page
• feat-38842-pf5-input-factory
• feat-39281-caport
• feat-39288-puppet-port
• feat-39361-ruby-3.3
• feat-39370-bump-safemode
• feature-38173
• feature/add-kickstart-dynamic-ptable
• feature/domain-name-host-regexp-validation
• feature/openvox-client
• fix-39121
• fix-39121-3.17
• fix-39121-3.18
• fix-ct_location
• fix-exit-in-recurring-tasks
• fix-long-footer-text-on-login
• fix-no-search
• fix-secure-headers
• fix-test-filtersForm
• fix/38549
• fix/39100-ubuntu-autoinstall-timezone
• fix/39243
• fix/39474
• fix/add-cloud-provider-stub-to-base-fact-parser
• fix/bump-uuid-v13
• fix/config-report-n-plus-1-query
• fix/cve-2026-33176-number-converter-dos
• fix/database-query-optimizations
• fix/document-uuid-param-hosts-api
• fix/drop-bootloader-location-mbr
• fix/exclude-last-used-at-from-pat-auditing
• fix/exclude-timestamp-fact
• fix/hide-taxonomy-options-with-resource-description
• fix/hostgroup-read-paths
• fix/hosts-search-percent-crash
• fix/katello-ci-pin-3.19
• fix/puppet-conf-hostcert-renewal
• fix/redhat-register-host-tools-defaults
• fix/registration-checkbox-alignment
• fix/remove-bindmethods
• fix/remove-puppet5-references
• fix/replace-uuid-v1-with-v4
• fix/rhsm-os-race-condition
• fix/rhsm-os-toctou-race
• fix/root-pass-length-outside-build
• fix/skip-compute-orch-unmanaged-hosts
• fix/skip-compute-orchestration-unmanaged-hosts
• fix/strip-cidr-from-subnet-network
• fix/topbar-sweeper-thread-safety
• fix/ubuntu_snapshots/38229
• fix/update-foreman-debug-manpage
• fix/url-validator-require-host
• fixPipeline
• fixTableIndexPage
• fix_3073_bmc_reboot_reset_patch1
• fix_35375
• fix_37523
• fix_37602_2
• fix_37834__2
• fix_37956
• fix_38706
• fix_38733
• fix_38736
• fix_38747
• fix_38855
• fix_38877
• fix_38959
• fix_38972
• fix_39094
• fix_39105
• fix_39165
• fix_39278
• fix_39279
• fix_39347
• fix_39389
• fix_39417
• fix_39447
• fix_39463
• fix_facter_tests
• fix_operatingsystem_deduplication
• fix_puppet_on_sles
• fix_saltstack_tmpl
• fix_skip_failure_on_upgrade_run
• fix_template_kinds_without_compute_attrs
• fix_tests
• fix_update-ca_debian
• fix_warning
• fixes-38875-tableindexpage-empty-state
• fixes-38949
• fixes-39131-global-registration-https
• fixes-39272-redhat-register-cleanup
• fixes-39273-editor-showhide-cleanup
• fixes-39340-use-ids-for-css-rules
• fixes-39374-ipmi-boot-parent-permission-taxonomy
• fixes-39401-deprecate-messagebox
• fixes-39422-register-host-layout
• fixes-39426-better-ouiaid-actionbutton-tableindexpage
• fixes-39439-audits-page-test
• fixes-39442-login-page
• fixes-39443-audits-page-actions
• fixes-39445-audits-page-selectors
• fixes-39451-registration-advanced-component
• fixes-39452-registration-command-component
• fixes-39453-config-params-field
• fixes-39454-general-component
• fixes-39455-host-group-field
• fixes-39457-repository-field
• fixes-39458-taxonomies
• fixes-39459-token-life-time
• fixes/37665_context_based_react_permissions
• fixes_39173_locked_report_template_after_cloning
• fixes_39176
• flatpak-lb-cert-fix
• gce-cleanup
• gh-actions-on-scripts
• graphql-host-parameters-attributes
• head-toolbar-checkmark
• hoc_tests
• host-dropdown-update
• host-index-expansion
• hostsIndex_refactor
• hw_models_pf5
• i39012
• i39037
• i39123
• i39124
• icon_hover
• imporve_installer_task_log_message
• includes
• incorect-name-foreman
• iso_date_tests
• issue-38338
• issue-38790
• issue-39212
• issue39005
• issue39006
• issue_36929
• jquery3
• json_partial
• jwt-warning
• kickstart-default-cleanup
• kickstart-output
• ldap-rfc4519
• legend_helpers
• linechart-deprecation
• lint-magic-numbers
• lint-vendor-import-resolve
• logout-redirect
• long_datetime_tests
• ls/38400
• ls/38511
• ls/38983
• ls/39191
• ls/39310
• ls/bug-38782
• ls/dev_provisioning
• ls/first-boot-service
• ls/first-run-green
• ls/form-hostgroupid
• ls/https_dev
• ls/libvirt0140
• ls/msg
• ls/norm318
• ls/norm319
• ls/orch-host-klass
• ls/orch17
• ls/ovirt-drop
• ls/refs-39293
• ls/reg_auth
• ls/settings-3-16
• ls/settings-value-response
• ls/sp_ids_bmc
• ls/transient_host_params
• ls/unattended-log
• ls/unattended_host_finder
• manage_repos_true
• managed-columns
• managed_interfaces_dont_initialize_without_subnet
• matchity-match
• mock-metadata
• models-required-name
• more-3.14-picks
• more39006
• more39020
• move-21-filters-test
• move-css-foreman-js
• moveFieldToCore
• moveRobotteloTestToUpstream
• move_foremanmodal_fix_to_foreman
• nav-query-exapnd
• no-pry-byebug
• node22
• ntp-fix
• ntp318
• ofedoren-CVE-2025-9572
• oidc-support
• opensuse-leap-15
• package_add_test_lib
• packit-npm-deps
• page-layout-allow-components
• pagelayout-pf5
• patch-1
• pats
• pf-templates-vendor
• pf3-datepicker
• pf5-buttons
• pf5-buttons-config-reports
• pf5-buttons-layout-export
• pf5-buttons-table-delete
• pf5-charts
• pf5-config-reports
• pf5-counter
• pf5-datetime
• pf5-editor-nav-bar
• pf5-editor-nav-bar-tmp
• pf5-form-field
• pf5-form-field_2
• pf5-impersonate-icon
• pf5-iso-date
• pf5-layout-toolbar
• pf5-message-box
• pf5-radiobutton-group
• pf5-setttings-table
• pf5-status
• pf5-substring-wrapper
• pf5-update
• pick39123
• pin-bootstrap
• pin-regen
• ping-ui
• provide_openvox_repo
• proxy-capsules
• prprocessorspam
• prxycaps
• puppet-docs
• push-yupmstmkrowy
• radio-position-css
• react-templates
• reactmodels
• rebuild_requires_poweroff
• redirect_to_new_all_hosts_page
• refactor/remove-https-menuentries-grub2
• refs_38551
• refs_38888
• registration-docs
• registration-failure-output
• registration-insights
• registration-observability
• registration/add-registration-logger
• registration/additive-fact-import
• registration/bulk-fact-inserts
• registration/bulk-insert-fact-values
• relative_datetime_tests
• remove-bmc-ssh
• remove-foreman-test-import
• remove-foreman-vendor
• remove-foreman-vendor-evgeni
• remove-old-grub-templates
• remove-react-ellipsis-with-tooltip
• remove-snapshot-static-wrappers
• remove-undefined-method
• remove_subscriptions_reporting
• restrictSearch
• rm_pxegrub
• roles-taxonomy-on-create
• sat_42220
• sat_42220_qa_failure
• scped-ord
• search-toolbar-css
• selectallcheckbox
• set-root-pass
• set_error_on_ssh_failure
• settings-errors
• short_datetime_tests
• sloop-json-b
• snapshot-slot-test
• split/authorizer-optimization
• ssh-cert-support
• stable-tests
• subnet
• subscript-refresh
• table-index-body
• table-wrap-headers
• templateGen_update
• template_seed_error_handling
• test-a-fix
• test-guidelines
• test-guidelines-update
• test_card
• test_existing_database
• test_setup_edit
• tests_modal
• unknown-proxy-features
• update-editorhostselect
• update-icons
• update-insights-for-lightspeed-branding
• update-loader-to-pf5
• update-modal-progress-bar
• update-style-loader
• update-translations
• update-translations-3.18
• update-vmware
• update/DonutChartWrapper-pf5
• upstream/fix-apt-remove-for-global-registration
• user-tax
• view-hg
• vmware
• vmware-select-38209
• voxpupuli-repo
• webpack-cache-test

Build # 28521009755

Build Type

Pull #11072

github

Committed by web-flow

Commit Message

Merge 295e292f8 into b96b9cca4

Pull Request Pull Request #11072: Fixes #39480 - CVE-2026-5135: Unauthorized modification of host configurations

Coverage Stats

2198 of 3994 branches covered (55.03%)

5649 of 8057 relevant lines covered (70.11%)

47.98 hits per line