CVE-2014-0135: Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_...

Security readout for executives and security teams

This CVE is a local information disclosure issue in Kafo, used by Foreman. Certain versions created default_values.yaml with world-readable permissions, allowing local users on the same system to view passwords and other sensitive values stored there. Exposure is most likely on systems running Foreman with affected Kafo versions and local user access. Internet exposure is not supported by the provided evidence. Prioritize remediation where Foreman hosts have multiple local users, shared administration, or stored service credentials. Treat confirmed exposure as a credential-handling incident. Mitigation focus: Upgrade Kafo to a non-affected version: 0.3.17 or later, or 0.5.2 or later.; Check Foreman security guidance for any product-specific remediation details.; Restrict default_values.yaml permissions so only required privileged users can read it..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.