CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1)
Foreman patched CVE-2026-12544, an SSTI and unsafe-deserialization bug that can execute code at startup.
Foreman released fixes for CVE-2026-12544, covering server-side template injection and unsafe deserialization in configuration handling. An attacker who can influence Foreman configuration can cause template evaluation or unsafe deserialization when foreman-rake starts, leading to code execution in a privileged service context. Fixes are in 3.19.2 and 5.0.1; the notice says affected versions begin at Foreman 1.0. No in-the-wild exploitation is described.
- Configuration influence can trigger SSTI or unsafe deserialization in Foreman.
- Code execution occurs during foreman-rake startup in a privileged service context.
- Fixes are in Foreman 3.19.2 and 5.0.1; affected lines start at 1.0.
- The disclosure does not report exploitation in the wild.
Vulnerabilities mentionedAll →
- CVE-2026-125447.7—SSTI and insecure deserialization in Foreman initializationpublished · The Foreman Project Foreman
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12544 | SSTI and insecure deserialization in Foreman initialization A flaw in Foreman’s foreman-rake initialization logic in /usr/share/foreman/config/settings.rb processes configuration through two executable layers, enabling server-side template injection and insecure deserialization (CWE-502). Successful abuse can lead to code execution with high impact on confidentiality, integrity, and availability, and the advisory describes risk of broader infrastructure and supply-chain compromise. The published CVSS 3.1 score is 7.7 (AV:L/AC:L/PR:H/UI:R/S:C), so the scored path is local, requires high privileges and user interaction, and can affect a changed security scope. Affected version ranges are not stated in the provided data. It is not listed in CISA KEV and no public proof-of-concept is known. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration An attacker who can influence Foreman configuration can trigger server-side template evaluation or unsafe deserialization during `foreman-rake` startup, leading to code execution in a privileged service context. Affected versions: Foreman 1.0...
This source does not provide full text. Read it at seclists.org.