https://seclists.org/oss-sec/2026/q4/68: CVE-2026-12540: Foman: command injection in foman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1)

Q: Which Foreman releases need to be remediated?

Foreman versions 2.2.0 through 3.19.1, plus version 5.0.0, are affected. The issue is fixed in Foreman 3.19.2 and 5.0.1.

Q: What level of access does an attacker need?

An attacker needs permission to run the restricted foreman-rake log task. Exploitation uses the task's request identifier parameter and is rated as requiring high privileges with local access.

Q: What is the potential impact on the server?

Successful exploitation can result in command execution on the Foreman server. The unsafe shell handling can compromise confidentiality, integrity, and availability, including across a changed security scope.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Foreman>=2.2.0<=3.19.1, =5.0.0

Frequently Asked Questions

Which Foreman releases need to be remediated?

Foreman versions 2.2.0 through 3.19.1, plus version 5.0.0, are affected. The issue is fixed in Foreman 3.19.2 and 5.0.1.

What level of access does an attacker need?

An attacker needs permission to run the restricted foreman-rake log task. Exploitation uses the task's request identifier parameter and is rated as requiring high privileges with local access.

What is the potential impact on the server?

Successful exploitation can result in command execution on the Foreman server. The unsafe shell handling can compromise confidentiality, integrity, and availability, including across a changed security scope.