Foreman patches eight access and code-execution flaws

Foreman 3.19.2 and 5.0.1 fix seven flaws, and Remote Execution patches command injection; no advisory reports active exploitation.

On 7 October 2026, oss-security posts described eight fixes for Foreman, an open-source lifecycle tool for physical and virtual servers, and its Remote Execution job plugin. Seven core issues are fixed in Foreman 3.19.2 and 5.0.1: Viewer over-access through template preview (CVE-2026-96659, from 1.9.0), which can reach service-account code execution if Safemode is disabled or bypassed; a separate Safemode bypass to Ruby execution (CVE-2026-96658) in builds bundling Safemode before 2.0.1; SSTI and unsafe deserialization at foreman-rake startup (CVE-2026-12544, from 1.0); and command injection in foreman-tail (CVE-2026-12542, CVSS 5.3), foreman-rake database tasks (CVE-2026-12541), and errors:fetch_log (CVE-2026-12540). CVE-2026-12423 lets unauthenticated requests use an IP/MAC fallback on token-enabled Red Hat-family provisioning and expose build data. Remote Execution command injection via effective_user (CVE-2026-12405) is fixed in 16.6.6, 17.2.2, and 18.0.1. None of the notices report exploitation in the wild. The CVE-2026-12541 post lists affected releases as 1.5.0 through 3.19.1 while also citing a 5.0.1 fix, and unlike CVE-2026-12542 and CVE-2026-12540 it does not explicitly name 5.0.0 as affected.

• Eight CVEs were posted on oss-security on 2026-10-07: seven in Foreman, fixed in 3.19.2 and 5.0.1, and Remote Execution CVE-2026-12405, fixed in 16.6.6, 17.2.2, and 18.0.1.
• CVE-2026-96659 (Foreman from 1.9.0): the Viewer role can read data beyond intended limits via template preview; if Safemode is disabled or bypassed, code can run as the Foreman service account.
• CVE-2026-96658: a low-privilege user allowed to render templates can bypass Safemode in builds bundling Safemode before 2.0.1 and execute Ruby as the Foreman service.
• CVE-2026-12544 (from Foreman 1.0): influencing configuration can trigger SSTI or unsafe deserialization when foreman-rake starts, executing code in a privileged service context.
• CVE-2026-12542 is local command injection in foreman-tail, affecting 1.5.0 through 3.19.1 and 5.0.0, scored CVSS 5.3; CVE-2026-12540 is command injection in foreman-rake errors:fetch_log via the request identifier, affecting 2.2.0 through…
• CVE-2026-12541 is command injection in foreman-rake database file-path parameters; the post lists 1.5.0 through 3.19.1 as affected and fixes in 3.19.2 and 5.0.1, and says abuse can compromise the server and database.
• CVE-2026-12423: unauthenticated requests can reach build-host provisioning through an IP/MAC fallback without a valid token on token-enabled Red Hat-family configurations and expose provisioning data.