https://seclists.org/oss-sec/2026/q4/70: CVE-2026-12405: Foman mote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1)

Q: Who can exploit this vulnerability?

An authenticated user who has permission to execute job templates can exploit it. The attacker can inject commands through the overridable effective_user parameter when invoking a job.

Q: What level of access does successful exploitation provide?

Injected commands execute on managed hosts with the privileges of the execution user. The published CVSS vector rates the issue 8.8 and indicates high impact to confidentiality, integrity, and availability.

Q: Which releases are affected and which releases contain the fix?

Affected releases are 0.1.2 through 16.6.5, 16.7.0, 17.0.0 through 17.2.1, and 18.0.0. Fixed releases are 16.6.6, 17.2.2, and 18.0.1.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Foreman Remote Execution>=0.1.2<=16.6.5, =16.7.0, >=17.0.0<=17.2.1, =18.0.0

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated user who has permission to execute job templates can exploit it. The attacker can inject commands through the overridable effective_user parameter when invoking a job.

What level of access does successful exploitation provide?

Injected commands execute on managed hosts with the privileges of the execution user. The published CVSS vector rates the issue 8.8 and indicates high impact to confidentiality, integrity, and availability.

Which releases are affected and which releases contain the fix?

Affected releases are 0.1.2 through 16.6.5, 16.7.0, 17.0.0 through 17.2.1, and 18.0.0. Fixed releases are 16.6.6, 17.2.2, and 18.0.1.