Foreman (Organization): news timeline & CVEs

CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1)

Authenticated Foreman Remote Execution users can inject commands via effective_user; fixed in 16.6.6, 17.2.2, and 18.0.1.

Ondrej Gajdusek disclosed CVE-2026-12405 in Foreman Remote Execution, the open-source job plugin for Foreman. An authenticated user allowed to execute job templates can inject commands through the overridable effective_user parameter because input is handled unsafely. Fixes shipped in versions 16.6.6, 17.2.2, and 18.0.1. The post does not report observed exploitation.

oss-securityOct 7, 04:49 UTC · 10d agoVulnerability 8 sources CVE-2026-124051

CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)

Unauthenticated Foreman requests can bypass provisioning tokens via IP/MAC fallback and expose build data.

CVE-2026-12423 is a provisioning token validation flaw in Foreman, the open-source server lifecycle tool. An unauthenticated request can reach build-host provisioning through an IP/MAC fallback when no valid token is supplied, in token-enabled Red Hat-family configurations, and can expose provisioning data. The issue is fixed in Foreman 3.19.2 and 5.0.1. Exploitation in the wild is not reported.

oss-securityOct 7, 04:47 UTC · 10d agoVulnerability 8 sources CVE-2026-124231

CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1)

Restricted foreman-rake users can inject commands via errors:fetch_log and compromise the Foreman server.

CVE-2026-12540 is a command injection flaw in Foreman's restricted foreman-rake errors:fetch_log task. A user permitted to run that task can cause command execution through the request identifier parameter because of unsafe shell handling, which can compromise the Foreman server. Affected releases are Foreman 2.2.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. No active exploitation is stated.

oss-securityOct 7, 04:45 UTC · 10d agoVulnerability 8 sources CVE-2026-125401

CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1)

Foreman patched CVE-2026-12541, a command injection in foreman-rake database tasks that can compromise the server.

Ondrej Gajdusek announced a fix for CVE-2026-12541 in Foreman, an open-source lifecycle management tool for physical and virtual servers. A user allowed to run restricted foreman-rake database tasks can trigger command execution through file-path parameters because of unsafe shell handling, which can compromise the Foreman server and its database. Affected versions include Foreman 1.5.0 through 3.19.1, with fixes in 3.19.2 and 5.0.1. The post does not report observed exploitation.

oss-securityOct 7, 04:43 UTC · 10d agoVulnerability 8 sources CVE-2026-125412

CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1)

Foreman fixed CVE-2026-12542, a local command injection in foreman-tail that can run arbitrary commands.

Foreman patched CVE-2026-12542, a command-injection flaw in foreman-tail. A local user who can reach the tool can supply input that is evaluated unsafely and run arbitrary commands on the Foreman server. Affected releases are 1.5.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. The issue is scored CVSS 5.3, and the disclosure does not report active exploitation.

oss-securityOct 7, 04:41 UTC · 10d agoVulnerability 8 sources CVE-2026-12542

CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1)

Foreman patched CVE-2026-12544, an SSTI and unsafe-deserialization bug that can execute code at startup.

Foreman released fixes for CVE-2026-12544, covering server-side template injection and unsafe deserialization in configuration handling. An attacker who can influence Foreman configuration can cause template evaluation or unsafe deserialization when foreman-rake starts, leading to code execution in a privileged service context. Fixes are in 3.19.2 and 5.0.1; the notice says affected versions begin at Foreman 1.0. No in-the-wild exploitation is described.

oss-securityOct 7, 04:40 UTC · 10d agoVulnerability 8 sources CVE-2026-125441

CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1)

Hammer CLI fixed CVE-2026-12545, a local editor command injection that can escalate privileges.

Hammer CLI, the command-line interface for Foreman, fixed CVE-2026-12545, an editor command-injection flaw. A local attacker who can influence the editor configuration can cause commands to run when a user starts the affected editor flow. If Hammer CLI runs with elevated privileges, the bug can lead to privilege escalation. Affected versions are 0.15.1 through 3.19.0 and 5.0.0, with fixes in 3.19.1 and 5.0.1.

oss-securityOct 7, 04:38 UTC · 10d agoVulnerability CVE-2026-125453

Foreman

Timeline7 articles

Related CVEsby mentions

Appears with