CVE-2026-12542: Foreman: command injection in foreman-tail
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Other sources
Description
The foreman-tail utility in Red Hat Satellite is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Impact
Successful exploitation allows a local attacker to escape restricted shells and execute arbitrary commands on the Satellite server. Consequently, the attacker could access sensitive information that could lead to remote code execution (RCE) and lateral movement across the managed infrastructure.
Recommendations
Refactor the script: Remove the use of eval. Use native shell array expansion or find to locate the necessary log files safely.
Input Validation: Implement a strict allow-list to ensure only valid service names are processed.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foreman (foreman-tail)to a version that resolves this vulnerability.Fixed in 3.19.2 - Upgrade
Upgrade
Foreman (foreman-tail)to a version that resolves this vulnerability.Fixed in 5.0.1 - Configuration
Implement a strict allow-list so that only valid service names are processed.
foreman-tail service-name input validation = strict allow-list - Configuration
Refactor foreman-tail to remove eval; use native shell array expansion or find to locate log files safely.
foreman-tail command execution = do not use eval
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker who can supply arguments to the foreman-tail utility can exploit it. The issue is particularly relevant where restricted-shell users can access the utility, because exploitation can allow them to escape shell restrictions.
What does an attacker need to provide to trigger the injection?
The attacker needs to pass user-controlled foreman-tail arguments containing shell metacharacters such as semicolons, ampersands, or pipes. Those arguments are incorporated into a string executed through eval without sanitization or quoting.
What is the likely impact after successful exploitation?
An attacker can execute arbitrary system commands on the Satellite server. This may expose sensitive information and could support further remote code execution or lateral movement across managed infrastructure.
Are fixes available?
The provided references list Red Hat errata RHSA-2026:74503, RHSA-2026:74504, and RHSA-2026:74506. Consult the applicable erratum for the affected deployment.