CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1)
Foreman fixed CVE-2026-12542, a local command injection in foreman-tail that can run arbitrary commands.
Foreman patched CVE-2026-12542, a command-injection flaw in foreman-tail. A local user who can reach the tool can supply input that is evaluated unsafely and run arbitrary commands on the Foreman server. Affected releases are 1.5.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. The issue is scored CVSS 5.3, and the disclosure does not report active exploitation.
44