Foreman (Product): news timeline & CVEs

CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1)

Authenticated Foreman Remote Execution users can inject commands via effective_user; fixed in 16.6.6, 17.2.2, and 18.0.1.

Ondrej Gajdusek disclosed CVE-2026-12405 in Foreman Remote Execution, the open-source job plugin for Foreman. An authenticated user allowed to execute job templates can inject commands through the overridable effective_user parameter because input is handled unsafely. Fixes shipped in versions 16.6.6, 17.2.2, and 18.0.1. The post does not report observed exploitation.

oss-securityOct 7, 04:49 UTC · 10d agoVulnerability 8 sources CVE-2026-124051

CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1)

Unauthenticated Foreman requests can bypass provisioning tokens via IP/MAC fallback and expose build data.

CVE-2026-12423 is a provisioning token validation flaw in Foreman, the open-source server lifecycle tool. An unauthenticated request can reach build-host provisioning through an IP/MAC fallback when no valid token is supplied, in token-enabled Red Hat-family configurations, and can expose provisioning data. The issue is fixed in Foreman 3.19.2 and 5.0.1. Exploitation in the wild is not reported.

oss-securityOct 7, 04:47 UTC · 10d agoVulnerability 8 sources CVE-2026-124231

CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1)

Restricted foreman-rake users can inject commands via errors:fetch_log and compromise the Foreman server.

CVE-2026-12540 is a command injection flaw in Foreman's restricted foreman-rake errors:fetch_log task. A user permitted to run that task can cause command execution through the request identifier parameter because of unsafe shell handling, which can compromise the Foreman server. Affected releases are Foreman 2.2.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. No active exploitation is stated.

oss-securityOct 7, 04:45 UTC · 10d agoVulnerability 8 sources CVE-2026-125401

CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1)

Foreman patched CVE-2026-12541, a command injection in foreman-rake database tasks that can compromise the server.

Ondrej Gajdusek announced a fix for CVE-2026-12541 in Foreman, an open-source lifecycle management tool for physical and virtual servers. A user allowed to run restricted foreman-rake database tasks can trigger command execution through file-path parameters because of unsafe shell handling, which can compromise the Foreman server and its database. Affected versions include Foreman 1.5.0 through 3.19.1, with fixes in 3.19.2 and 5.0.1. The post does not report observed exploitation.

oss-securityOct 7, 04:43 UTC · 10d agoVulnerability 8 sources CVE-2026-125412

CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1)

Foreman fixed CVE-2026-12542, a local command injection in foreman-tail that can run arbitrary commands.

Foreman patched CVE-2026-12542, a command-injection flaw in foreman-tail. A local user who can reach the tool can supply input that is evaluated unsafely and run arbitrary commands on the Foreman server. Affected releases are 1.5.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. The issue is scored CVSS 5.3, and the disclosure does not report active exploitation.

oss-securityOct 7, 04:41 UTC · 10d agoVulnerability 8 sources CVE-2026-12542

CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1)

Foreman patched CVE-2026-12544, an SSTI and unsafe-deserialization bug that can execute code at startup.

Foreman released fixes for CVE-2026-12544, covering server-side template injection and unsafe deserialization in configuration handling. An attacker who can influence Foreman configuration can cause template evaluation or unsafe deserialization when foreman-rake starts, leading to code execution in a privileged service context. Fixes are in 3.19.2 and 5.0.1; the notice says affected versions begin at Foreman 1.0. No in-the-wild exploitation is described.

oss-securityOct 7, 04:40 UTC · 10d agoVulnerability 8 sources CVE-2026-125441

CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1)

Hammer CLI fixed CVE-2026-12545, a local editor command injection that can escalate privileges.

Hammer CLI, the command-line interface for Foreman, fixed CVE-2026-12545, an editor command-injection flaw. A local attacker who can influence the editor configuration can cause commands to run when a user starts the affected editor flow. If Hammer CLI runs with elevated privileges, the bug can lead to privilege escalation. Affected versions are 0.15.1 through 3.19.0 and 5.0.0, with fixes in 3.19.1 and 5.0.1.

oss-securityOct 7, 04:38 UTC · 10d agoVulnerability CVE-2026-125453

CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1)

Katello Registry Proxy label parameters allow authenticated SQL injection that can cross authorization boundaries.

Katello, the content-management plugin for Foreman, patched CVE-2026-56097, a SQL injection in Registry Proxy label handling. An authenticated low-privilege user can pass unsanitized label parameters that are interpolated into database queries and expose data across authorization boundaries. Affected releases are Katello 4.13.0 through 4.21.1.1; the fix is in 4.21.2 and 5.0.1. The disclosure does not report active exploitation.

oss-securityOct 7, 04:36 UTC · 10d agoVulnerability 2 sources CVE-2026-560971

CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1)

Katello Registry Proxy lets low-privilege users bypass authorization and enumerate organizations and products.

Katello fixed CVE-2026-56098, an authorization bypass in the Registry Proxy. An authenticated low-privilege user can skip authorization checks and enumerate organizations and products by observing response differences. Affected versions are Katello 4.13.0 through 4.21.1.1 and 5.0.0, with a CVSS 3.1 score of 4.3 (Moderate). Fixes are in Katello 4.21.2 and 5.0.1; exploitation in the wild is not reported.

oss-securityOct 7, 04:34 UTC · 10d agoVulnerability 2 sources CVE-2026-560981

CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1)

Foreman Safemode bypass lets a low-privilege template user execute Ruby as the Foreman service.

Foreman patched CVE-2026-96658, a Safemode bypass that can lead to remote code execution. A low-privilege user who is permitted to render supplied template content can evade Safemode restrictions and execute Ruby with Foreman service privileges. The issue affects Foreman releases that bundle Safemode before 2.0.1. Fixes are in Foreman 3.19.2 and 5.0.1; the advisory does not report observed exploitation.

oss-securityupdated Oct 7, 04:49 UTC · 10d agofirst Oct 7, 04:32 UTC · 10d agoVulnerability 8 sources CVE-2026-966581

CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1)

Foreman Viewer role can access extra data via template preview and, if Safemode is off, reach code execution.

Foreman fixed CVE-2026-96659, which grants the Viewer role excessive access through template preview. Viewers can reach data outside intended authorization boundaries. Where Safemode is disabled or bypassed, the same path can lead to code execution as the Foreman service account. Affected versions start at Foreman 1.9.0, and the fix ships in 3.19.2 and 5.0.1. Active exploitation is not reported.

oss-securityupdated Oct 7, 04:49 UTC · 10d agofirst Oct 7, 04:30 UTC · 10d agoVulnerability 8 sources CVE-2026-966591

Critical Red Hat Satellite Flaw Could Enable Root Password Theft and Code Execution Attacks

Red Hat fixed Satellite flaw CVE-2026-96659, which can leak host root passwords and enable Foreman command execution.

Red Hat disclosed CVE-2026-96659, an authorization flaw in Foreman template preview endpoints used by Red Hat Satellite, rated Important with CVSS 9.1. An authenticated Viewer-role user can retrieve sensitive host attributes, including root passwords. If Foreman Safemode is off or bypassed, the flaw can allow command execution as the Foreman service account; related CVE-2026-96658 is a Safemode bypass that can lead to remote code execution. Patches are available for Satellite 6.16, 6.18, and 6.19 via RHSA-2026:74506, RHSA-2026:74504, and RHSA-2026:74503.

Cyber Security NewsOct 2, 13:14 UTC · 14d agoVulnerability CVE-2026-96659 CVE-2026-966582

Foreman

Timeline12 articles

Related CVEsby mentions

Appears with