CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1)
Restricted foreman-rake users can inject commands via errors:fetch_log and compromise the Foreman server.
CVE-2026-12540 is a command injection flaw in Foreman's restricted foreman-rake errors:fetch_log task. A user permitted to run that task can cause command execution through the request identifier parameter because of unsafe shell handling, which can compromise the Foreman server. Affected releases are Foreman 2.2.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. No active exploitation is stated.
- Restricted foreman-rake errors:fetch_log users can trigger command execution.
- The request identifier parameter is passed through unsafe shell handling.
- Successful injection can compromise the Foreman server.
- Affects 2.2.0 through 3.19.1 and 5.0.0; fixed in 3.19.2 and 5.0.1.
Vulnerabilities mentionedAll →
- CVE-2026-125408.2—Command injection in Foreman foreman-rake fetch_logpublished · theforeman Foreman
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12540 | Command injection in Foreman foreman-rake fetch_log A local command-injection flaw (CWE-78) exists in Foreman’s foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command, typically grep, without adequate shell neutralization, so shell metacharacters can break out of the intended command. An attacker who already has sudo permission to run this rake task can execute arbitrary code with the privileges of that command, with high impact on confidentiality, integrity, and availability beyond the task’s scope. Affected Foreman releases are not named in the provided data. There is no known public proof of concept and the issue is not listed in CISA KEV. Do: Limit sudo permission for the foreman-rake errors:fetch_log task to fully trusted administrators only. Apply the vendor security update for Foreman as soon as it is published, and review sudo and task logs for request_id values that contain shell metacharacters such as semicolons, quotes, or pipes. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log A user allowed to run the restricted `foreman-rake` log task can cause command execution through its request identifier parameter. Unsafe shell handling can compromise the Foreman server. Affected versions: Foreman 2.2.0 through 3.19.1, and 5.0.0...
This source does not provide full text. Read it at seclists.org.