https://seclists.org/oss-sec/2026/q4/65: CVE-2026-12544: Foman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1)

Q: What level of access does an attacker need to exploit this issue?

The attacker must be able to influence Foreman configuration. The published vector is local, with high privileges required and user interaction required according to the CVSS vector.

Q: When does exploitation occur, and what is the likely impact?

The vulnerable behavior is triggered during foreman-rake startup. Successful exploitation can result in code execution in a privileged service context through server-side template evaluation or unsafe deserialization.

Q: Are all affected releases exposed to the ERB template-evaluation path?

No. The ERB execution path begins with Foreman 1.15.0. Earlier affected releases may still be affected by the unsafe deserialization aspect described in the advisory.

Q: What versions contain the fix?

The issue is fixed in Foreman 3.19.2 and 5.0.1.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Foreman>=1.0<=3.19.1, =5.0.0

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be able to influence Foreman configuration. The published vector is local, with high privileges required and user interaction required according to the CVSS vector.

When does exploitation occur, and what is the likely impact?

The vulnerable behavior is triggered during foreman-rake startup. Successful exploitation can result in code execution in a privileged service context through server-side template evaluation or unsafe deserialization.

Are all affected releases exposed to the ERB template-evaluation path?

No. The ERB execution path begins with Foreman 1.15.0. Earlier affected releases may still be affected by the unsafe deserialization aspect described in the advisory.

What versions contain the fix?

The issue is fixed in Foreman 3.19.2 and 5.0.1.