CVE-2026-96658: Foreman: safemode bypass leading to rce
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
Other sources
A Safemode bypass attack has been identified that exposes a number of weaknesses in Foreman leading to low-privilege (i.e. minimum "view" permissions) to be able to perform limited Remote Code Execution (RCE). It appears that a copy of the delegatemethods to the local scope allows an adversary to append eval to the permitted methods list leveraged by safemode, thus permitting RCE through the templating engine.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Foreman user with minimum view_* permissions can exploit it. No user interaction is required.
What level of access can exploitation provide?
The flaw permits limited remote code execution through Foreman’s templating engine, allowing arbitrary commands to run on the hosting server. The reported impact includes high confidentiality, integrity, and availability consequences.
What component or condition is required for exploitation?
Exploitation relies on access to the templating engine and the safemode sandbox. The attacker abuses delegated-method handling to add eval to the methods permitted by safemode.
How can I determine whether my deployment is exposed?
Review whether low-privilege authenticated users with view_* permissions can access functionality that processes templates through Foreman’s safemode templating engine. The supplied information does not identify affected versions or a specific detection method.