AI analysis
A critical flaw in Foreman lets an authenticated user with only low-level permissions bypass the safemode sandbox in the templating engine. Improper handling of delegated methods allows the attacker to add unauthorized functions to the allowed execution list and then run arbitrary commands on the Foreman host. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability, and the CVSS scope is changed (network, low complexity, no user interaction). Affected version ranges are not specified in the provided data; operators of Foreman (and downstream products built on it) should treat unpatched templating hosts as in scope until vendors publish fixed releases. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the Foreman security update from the Foreman Project or your vendor (including Red Hat, which assigned this CVE) as soon as a fixed build is published for your release. Until then, restrict who can create or edit templates and other low-privilege roles that reach the templating engine, and review recent template changes and host command history for unexpected execution.
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.