CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1)
Foreman Safemode bypass lets a low-privilege template user execute Ruby as the Foreman service.
Foreman patched CVE-2026-96658, a Safemode bypass that can lead to remote code execution. A low-privilege user who is permitted to render supplied template content can evade Safemode restrictions and execute Ruby with Foreman service privileges. The issue affects Foreman releases that bundle Safemode before 2.0.1. Fixes are in Foreman 3.19.2 and 5.0.1; the advisory does not report observed exploitation.
- Users allowed to render templates can bypass Safemode.
- Bypass reaches Ruby code execution as the Foreman service.
- Affects Foreman builds bundling Safemode before 2.0.1.
- Fixed in Foreman 3.19.2 and 5.0.1; no in-the-wild exploitation reported.
Vulnerabilities mentionedAll →
- CVE-2026-966589.9—Authenticated safemode bypass RCE in Foremanpublished · Foreman Project Foreman
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-96658 | Authenticated safemode bypass RCE in Foreman A critical flaw in Foreman lets an authenticated user with only low-level permissions bypass the safemode sandbox in the templating engine. Improper handling of delegated methods allows the attacker to add unauthorized functions to the allowed execution list and then run arbitrary commands on the Foreman host. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability, and the CVSS scope is changed (network, low complexity, no user interaction). Affected version ranges are not specified in the provided data; operators of Foreman (and downstream products built on it) should treat unpatched templating hosts as in scope until vendors publish fixed releases. It is not listed in CISA KEV and no public proof-of-concept is known. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-96658: Foreman: Safemode bypass leading to RCE A low-privilege user permitted to render supplied template content can bypass Foreman's Safemode restrictions and reach Ruby code execution with Foreman service privileges. Affected versions: Foreman releases bundling Safemode before 2.0.1, including Foreman...
This source does not provide full text. Read it at seclists.org.