CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1)
Foreman patched CVE-2026-12544, an SSTI and unsafe-deserialization bug that can execute code at startup.
Foreman released fixes for CVE-2026-12544, covering server-side template injection and unsafe deserialization in configuration handling. An attacker who can influence Foreman configuration can cause template evaluation or unsafe deserialization when foreman-rake starts, leading to code execution in a privileged service context. Fixes are in 3.19.2 and 5.0.1; the notice says affected versions begin at Foreman 1.0. No in-the-wild exploitation is described.
50