https://seclists.org/oss-sec/2026/q4/66: CVE-2026-12542: Foman: command injection in foman-tail (fixed in 3.19.2, 5.0.1)
Published Oct 6, 2026
·Updated
Affected Software
1 affected component
Foreman Foreman>=1.5.0<=3.19.1, =5.0.0
Frequently Asked Questions
1
Who can exploit this issue?
A local user who has access to the foreman-tail utility can exploit it. The issue does not describe a remote attack path.
2
What level of access and interaction does exploitation require?
Exploitation requires low privileges and local access to foreman-tail. No user interaction is required, and the attack complexity is rated low.
3
Which releases should be upgraded?
Foreman 1.5.0 through 3.19.1, plus 5.0.0, are affected. Upgrade to Foreman 3.19.2 or 5.0.1.