https://seclists.org/oss-sec/2026/q4/61: CVE-2026-96658: Foman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1)

Q: Who can exploit this issue?

A low-privilege Foreman user who is permitted to render supplied template content can exploit it. No user interaction is required, and the published vector is network-accessible.

Q: What level of access can exploitation provide?

The Safemode bypass can lead to Ruby code execution with the privileges of the Foreman service. The advisory rates the issue CVSS 9.9 Critical, with high confidentiality, integrity, and availability impact.

Q: Which deployments are affected?

Foreman releases that bundle Safemode before version 2.0.1 are affected. Explicitly listed affected releases are Foreman 3.19.0, 3.19.1, and 5.0.0.

Q: What is the remediation?

Upgrade to Foreman 3.19.2 or 5.0.1, and ensure Safemode 2.0.1 or later is installed. The advisory does not provide an alternative mitigation for environments that cannot yet patch.

Published Oct 6, 2026

Updated

Affected Software

2 affected components

Foreman Foreman=3.19.0, =3.19.1, =5.0.0

Foreman Safemode<2.0.1

Frequently Asked Questions

Who can exploit this issue?

A low-privilege Foreman user who is permitted to render supplied template content can exploit it. No user interaction is required, and the published vector is network-accessible.

What level of access can exploitation provide?

The Safemode bypass can lead to Ruby code execution with the privileges of the Foreman service. The advisory rates the issue CVSS 9.9 Critical, with high confidentiality, integrity, and availability impact.

Which deployments are affected?

Foreman releases that bundle Safemode before version 2.0.1 are affected. Explicitly listed affected releases are Foreman 3.19.0, 3.19.1, and 5.0.0.

What is the remediation?

Upgrade to Foreman 3.19.2 or 5.0.1, and ensure Safemode 2.0.1 or later is installed. The advisory does not provide an alternative mitigation for environments that cannot yet patch.