CVE-2026-12541: Foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Other sources
Description
OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks within Red Hat Satellite (Foreman). The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution.
An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Impact
Exploitation allows a restricted user to escalate privileges to the foreman account and execute arbitrary commands . This grants control over the Satellite database and configurations, enabling lateral movement and full root Remote Code Execution on all managed hosts (as demonstrated in F-03 Command Injection in foreman-rake errors:fetchlog via requestid Parameter).
Recommendations
Validate Input: Implement strict validation for both the destination and file parameters in the Rake tasks to ensure they only contain valid filesystem paths and no shell metacharacters before processing.
Use Argument Arrays: Modify the underlying code to use non-shell execution methods (e.g., passing arguments as an array to system() or exec()) to prevent shell interpretation.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify the foreman-rake database tasks to use non-shell execution methods, such as passing arguments as an array to Ruby system() or using exec(), to prevent shell interpretation.
- Compensating control
Strictly validate the destination parameter in db:dump and the file parameter in db:import_dump so they contain only valid filesystem paths and no shell metacharacters before processing.
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
A user who already has permission to execute foreman-rake can exploit it, including a user granted access through a restricted sudo configuration. The issue is therefore primarily relevant where untrusted or lower-privileged users can run these database tasks.
Which operations are vulnerable?
The vulnerable operations are the foreman-rake db:dump task, through its destination parameter, and the db:import_dump task, through its file parameter. Supplying shell metacharacters in those path values can append commands passed to Ruby's system() call.
What is the impact of successful exploitation?
An attacker can escalate to the foreman account and execute arbitrary commands. This can provide control over Satellite database contents and configurations.
What should be restricted while remediation is pending?
Restrict access to foreman-rake, particularly db:dump and db:import_dump, and review restricted sudo rules that allow users to invoke it. Do not allow untrusted users to supply destination or file parameter values to these tasks.