AI analysis
A flaw in Foreman’s foreman-rake initialization logic in /usr/share/foreman/config/settings.rb processes configuration through two executable layers, enabling server-side template injection and insecure deserialization (CWE-502). Successful abuse can lead to code execution with high impact on confidentiality, integrity, and availability, and the advisory describes risk of broader infrastructure and supply-chain compromise. The published CVSS 3.1 score is 7.7 (AV:L/AC:L/PR:H/UI:R/S:C), so the scored path is local, requires high privileges and user interaction, and can affect a changed security scope. Affected version ranges are not stated in the provided data. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Treat this as a privileged local code-execution flaw until a vendor fix is confirmed. Apply the Foreman or Red Hat update that addresses CVE-2026-12544 as soon as it is published, and until then limit who can run foreman-rake or supply configuration consumed at initialization. Review hosts that process untrusted settings for signs of unexpected code execution and restrict administrative access to Foreman servers.
Affected
| The Foreman Project Foreman | — |
Estimated exposure
nicheunknown (enterprise Foreman/Satellite-class deployments; no public install census in the data) — No install count, version range, or internet-scan figure is in the CVE data; Foreman is an on-premises enterprise lifecycle-management server rather than a mass-deployed product, so exposure is estimated as niche.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.