CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1)
Foreman fixed CVE-2026-12542, a local command injection in foreman-tail that can run arbitrary commands.
Foreman patched CVE-2026-12542, a command-injection flaw in foreman-tail. A local user who can reach the tool can supply input that is evaluated unsafely and run arbitrary commands on the Foreman server. Affected releases are 1.5.0 through 3.19.1 and 5.0.0, with fixes in 3.19.2 and 5.0.1. The issue is scored CVSS 5.3, and the disclosure does not report active exploitation.
- Local foreman-tail users can inject commands through unsafely evaluated input.
- Successful exploitation allows arbitrary command execution on the Foreman server.
- Affects Foreman 1.5.0 through 3.19.1 and 5.0.0; fixed in 3.19.2 and 5.0.1.
- Rated CVSS 5.3; no in-the-wild exploitation is reported.
Vulnerabilities mentionedAll →
- CVE-2026-125427.8—OS Command Injection in Foreman foreman-tailpublished · Foreman Project Foreman
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12542 | OS Command Injection in Foreman foreman-tail Foreman’s foreman-tail utility has an OS command injection flaw (CWE-78) caused by passing unsanitized user arguments into a string that eval executes to expand file paths. A local attacker who can already run the utility with low privileges can insert shell metacharacters such as ;, &, or | and run arbitrary system commands. Impact is limited to low confidentiality, integrity, and availability on the local host (CVSS 3.1 base score 5.3; local attack, low privileges, no user interaction). Organizations running Foreman releases before the 3.19.2 and 5.0.1 fixes are affected. There is no known public proof of concept and the issue is not listed in CISA KEV. Do: Upgrade Foreman to 3.19.2 or 5.0.1 (or a later release on the same branch). Until then, limit which local accounts can run foreman-tail and treat unexpected shell metacharacters in its arguments as suspicious. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-12542: Foreman: command injection in foreman-tail A local user with access to `foreman-tail` can inject commands because user input is evaluated unsafely. Successful exploitation allows arbitrary command execution on the Foreman server. Affected versions: Foreman 1.5.0 through 3.19.1, and 5.0.0 CVSS: 5.3...
This source does not provide full text. Read it at seclists.org.