CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1)
Authenticated Foreman Remote Execution users can inject commands via effective_user; fixed in 16.6.6, 17.2.2, and 18.0.1.
Ondrej Gajdusek disclosed CVE-2026-12405 in Foreman Remote Execution, the open-source job plugin for Foreman. An authenticated user allowed to execute job templates can inject commands through the overridable effective_user parameter because input is handled unsafely. Fixes shipped in versions 16.6.6, 17.2.2, and 18.0.1. The post does not report observed exploitation.
48