REDHAT-BUG-2534185: High severity Foreman Foreman vulnerability
A Safemode bypass attack has been identified that exposes a number of weaknesses in Foreman leading to low-privilege (i.e. minimum "view" permissions) to be able to perform limited Remote Code Execution (RCE). It appears that a copy of the delegatemethods to the local scope allows an adversary to append eval to the permitted methods list leveraged by safemode, thus permitting RCE through the templating engine.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue can be exploited by a low-privilege Foreman user with at least the minimum "view_*" permissions.
What capability could exploitation provide?
Successful exploitation permits limited remote code execution through Foreman's templating engine, by adding eval to the methods allowed by safemode.
Which remediation sources should be checked for affected releases?
Red Hat has published remediation information in RHSA-2026:74504, RHSA-2026:74505, and RHSA-2026:74506.