An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.

A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.

Hi,

A security fix has been released in Foreman Remote Execution, an open-source plugin for Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12405: Foreman Remote Execution: command injection via effectiveuser

An authenticated user with permission to execute job templates can inject commands through the overridable effectiveuser parameter during job invocation. Improper input handling allows command execution with the execution user's privileges on managed hosts.

Affected versions: Foreman Remote Execution 0.1.2–16.6.5, 16.7.0, 17.0.0–17.2.1, and 18.0.0 CVSS: 8.8 (Important) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fixed versions: Foreman Remote Execution 16.6.6, 17.2.2, and 18.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12405 - Redmine: https://projects.theforeman.org/issues/39836 - Fix: https://github.com/theforeman/foremanremoteexecution/pull/1072

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12423: Foreman: provisioning token validation flaw

An unauthenticated request can reach build-host provisioning through an IP/MAC fallback when no valid provisioning token is supplied. The fallback is reachable in token-enabled Red Hat-family provisioning configurations and can expose provisioning data.

Affected versions: Foreman 1.1 through 3.19.1, and 5.0.0 CVSS: 7.5 (Important) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12423 - Redmine: https://projects.theforeman.org/issues/39837 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetchlog

A user allowed to run the restricted foreman-rake log task can cause command execution through its request identifier parameter. Unsafe shell handling can compromise the Foreman server.

Affected versions: Foreman 2.2.0 through 3.19.1, and 5.0.0 CVSS: 8.2 (Important) CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12540 - Redmine: https://projects.theforeman.org/issues/39838 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12541: Foreman: command injection in foreman-rake database tasks

A user allowed to run restricted foreman-rake database tasks can cause command execution through file path parameters. Unsafe shell handling can compromise the Foreman server and its database.

Affected versions: Foreman 1.5.0 through 3.19.1, and 5.0.0 CVSS: 8.2 (Important) CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12541 - Redmine: https://projects.theforeman.org/issues/39839 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12542: Foreman: command injection in foreman-tail

A local user with access to foreman-tail can inject commands because user input is evaluated unsafely. Successful exploitation allows arbitrary command execution on the Foreman server.

Affected versions: Foreman 1.5.0 through 3.19.1, and 5.0.0 CVSS: 5.3 (Moderate) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12542 - Redmine: https://projects.theforeman.org/issues/39840 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration

An attacker who can influence Foreman configuration can trigger server-side template evaluation or unsafe deserialization during foreman-rake startup, leading to code execution in a privileged service context.

Affected versions: Foreman 1.0 through 3.19.1, and 5.0.0; the ERB execution path starts at 1.15.0 CVSS: 7.7 (Important) CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12544 - Redmine: https://projects.theforeman.org/issues/39841 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Hammer CLI, a command-line interface for Foreman.

CVE-2026-12545: Hammer CLI: editor command injection

A local attacker who can influence Hammer CLI's editor configuration can cause commands to execute when a user invokes the affected editor flow. If Hammer CLI runs with elevated privileges, this can result in privilege escalation.

Affected versions: Hammer CLI 0.15.1 through 3.19.0, and 5.0.0 CVSS: 6.7 (Moderate) CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Fixed versions: Hammer CLI 3.19.1 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12545 - Redmine: https://projects.theforeman.org/issues/39842 - Fix: https://github.com/theforeman/hammer-cli/pull/407

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Katello, a content management plugin for Foreman.

CVE-2026-56098: Katello: Registry Proxy authorization bypass

An authenticated low-privilege user can bypass Registry Proxy authorization checks and enumerate organizations and products through response differences.

Affected versions: Katello 4.13.0 through 4.21.1.1, and 5.0.0 CVSS: 4.3 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Fixed versions: Katello 4.21.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-56098 - Redmine: https://projects.theforeman.org/issues/39844 - Fix: https://github.com/Katello/katello/pull/11887

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-96658: Foreman: Safemode bypass leading to RCE

A low-privilege user permitted to render supplied template content can bypass Foreman's Safemode restrictions and reach Ruby code execution with Foreman service privileges.

Affected versions: Foreman releases bundling Safemode before 2.0.1, including Foreman 3.19.0, 3.19.1, and 5.0.0 CVSS: 9.9 (Critical) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1; Safemode 2.0.1 or later must be installed Credit: Robb Gatica

References: - Foreman Security: https://theforeman.org/security.html#2026-96658 - Redmine: https://projects.theforeman.org/issues/39845 - Fix: https://github.com/theforeman/safemode/pull/68 - Dependency update: https://github.com/theforeman/safemode/pull/69

Thanks, Ondrej Gajdusek Foreman Release Team

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

When accessing certain API endpoints (e.g. POSTing to /template/preview) a user with the Viewer role is able to access information they should not be able to (i.e. @host.rootpass). When the system is configured insecurely (i.e. Safemode is disabled), or a Safemode bypass vulnerability exists, then the Viewer is able to perform Remote Code Execution on the system as the foreman system account.

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

A Safemode bypass attack has been identified that exposes a number of weaknesses in Foreman leading to low-privilege (i.e. minimum "view" permissions) to be able to perform limited Remote Code Execution (RCE). It appears that a copy of the delegatemethods to the local scope allows an adversary to append eval to the permitted methods list leveraged by safemode, thus permitting RCE through the templating engine.

Hi,

Multiple security fixes have been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

---

CVE-2026-5136: Foreman: Privilege escalation via usergroup role assignment manipulation

The Usergroup model does not validate whether the calling user is permitted to assign the specified roles. A user with createusergroups or editusergroups permission can attach arbitrary roles to a usergroup via the API, add themselves as a member, and inherit elevated privileges.

Affected versions: all Foreman versions CVSS: 8.8 (Important) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5136 - Redmine: https://projects.theforeman.org/issues/39478 - Fix: https://github.com/theforeman/foreman/pull/11066

---

CVE-2026-5142: Foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass

The KeyPairsController#show action is excluded from the findcomputeresource callback that enforces taxonomy scoping. An authenticated user with the viewkeypairs permission can download the full PEM private key of any compute resource by database ID, bypassing organization and location boundaries.

Affected versions: all Foreman versions since 1.15.0 CVSS: 6.5 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5142 - Redmine: https://projects.theforeman.org/issues/39479 - Fix: https://github.com/theforeman/foreman/pull/11069

---

CVE-2026-5135: Foreman: Unauthorized modification of host configurations via broken access control

When lookup values are submitted as nested attributes during host or hostgroup updates, the match field is permitted and applied without ownership validation. A user with host-edit rights can retarget an existing lookup value override to point at a different host, injecting configuration values into hosts they are not authorized to edit.

Affected versions: all Foreman versions CVSS: 6.5 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5135 - Redmine: https://projects.theforeman.org/issues/39480 - Fix: https://github.com/theforeman/foreman/pull/11072

---

CVE-2026-5138: Foreman: Information disclosure via improper validation of nested request parameters

The taxonomyscope controller method loads organization and location IDs from nested request parameters without checking the user's taxonomy membership. An authenticated user with host-edit permissions can supply a foreign organization ID in nested parameters to scope AJAX queries to a tenant they do not belong to, leaking infrastructure metadata such as domains, subnets, and IP availability.

Affected versions: all Foreman versions since 1.7.0 CVSS: 4.3 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5138 - Redmine: https://projects.theforeman.org/issues/39481 - Fix: https://github.com/theforeman/foreman/pull/11075

---

Thanks, Ondrej Gajdusek Foreman Release Team

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Description

The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a Multi-Stage Execution Chain that allows for both Server-Side Template Injection (SSTI) and Insecure Deserialization.

The vulnerability execution chain has two stages:

Template Injection (ERB): The first stage uses ERB.new(...).result. This evaluates the file as a Ruby template. Any code inside <%= ... %> is executed by the Ruby interpreter to generate a string. This is an SSTI that allows for direct OS command injection.

Insecure Deserialization (YAML): The second stage takes the rendered string and passes it to YAML.load. Because this is an unsafe parser, it allows for object injection. Even if an attacker cannot use ERB tags, they can craft YAML that instantiates malicious Ruby "gadget chains" to achieve code execution.

The vulnerability exists in two different application functionalities, thus it can be exploited in two different ways:

Primary config:

SETTINGS.merge! YAML.load(ERB.new(File.read(settingsfile)).result) allows an attacker to craft a malicious /etc/foreman-maintain/foremanmaintain.yml file that will be loaded and executed by foreman-rake on start.

Plugins config:

SETTINGS.merge! YAML.load(ERB.new(File.read(f)).result) allows an attacker to craft a malicious file that will be executed from /usr/share/foreman/config/settings.plugins.d/ by foreman-rake on start.

Impact

Indirect Triggering & Privileged RCE: foreman-rake exposes underlying execution primitives that higher-level orchestration tools (like foreman-maintain or foreman-installer) rely on to interact with the application. Because these tools implicitly pass commands down, the vulnerability can be triggered indirectly during routine administrative operations, resulting in Remote Code Execution (RCE) in a high-trust context (often foreman or root).

Total Infrastructure Compromise: Compromising the management plane (Satellite server) allows an attacker to pivot and execute arbitrary code across all Satellite Managed Hosts.

Supply Chain Risk: While direct local exploitation requires prior root access, this flaw presents a critical supply chain risk. An adversary could distribute malicious plugins or compromised configuration files through public repositories (e.g., RubyGems, GitHub). Note: The CVSS vector and severity are based on this supply chain attack vector.

RECOMMENDATIONS

Replace YAML.load with YAML.safeload(content, permittedclasses: [Symbol]) in both locations in settings.rb.

Remove the ERB.new().result evaluation. Configuration files must be treated as static data, never as executable templates.

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's validhosttoken? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in privilege escalation and infrastructure-wide code execution.

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug logging is enabled, incompletely sanitizes HTTP request headers, leading to the cleartext logging of sensitive information such as authorization tokens and API keys. This vulnerability can result in a confidentiality breach, as sensitive authentication data is persisted in plain text within container logs, increasing the risk if logs are forwarded to a centralized platform.

Description The foreman-mcp-server contains two distinct logging mechanisms that expose sensitive session and authentication data.

Exposure occurs across two tiers:

Diagnostic Over-logging (INFO Level): The server relies on the MCP Python SDK (Upstream: modelcontextprotocol/python-sdk). By default, this library logs the creation of new transports and their associated mcp-session-id at the INFO level. While this is standard diagnostic behavior for the SDK, the foreman-mcp-server implementation fails to suppress or filter these logs. Because the server improperly treats the session ID as an authentication credential (as proven in F-34 MCP Server: Active Session Hijacking via Insecure Session State Reuse), this default behavior results in the leakage of session secrets in standard, non-debug application logs.

Incomplete Sanitization Logic (DEBUG Level): The LoggingMiddleware (src/foremanmcpserver/middleware/logging.py) records the full HTTP request header dictionary when the log level is set to DEBUG. This middleware utilizes a negative security model (block-list) that only masks four hardcoded keys: foremanpassword, foremantoken, password, and token. Any header not explicitly on this list, such as Authorization, Cookie, or X-Satellite-Secret, is logged in cleartext.

IMPACT

Confidentiality Breach: Sensitive Bearer tokens, Session IDs, and API keys are persisted in plain text within the container logs.

Log Aggregation Risk: If logs are forwarded to a centralized platform (e.g., ELK, Splunk, CloudWatch), the secrets become searchable and accessible to a wider pool of users (developers, auditors, SREs) who may not have authorization to the Foreman API itself.

Non-Compliance: This behavior directly violates global security standards that prohibit the storage of sensitive authentication data in audit logs.

RECOMMENDATIONS

Address Diagnostic Verbosity (Dependency Fix): Configure the application's logging dictionary to set the mcp.server logger to WARNING or higher. This will suppress the default INFO level transport creation logs from the SDK.

Adopt an Allow-list (Positive Security Model): Re-engineer sanitizeheaders to mask all header values by default. Only allow-list known non-sensitive headers (e.g., host, user-agent, accept, content-type).

REFERENCES

CWE-532: Insertion of Sensitive Information into Log File

OWASP Logging Cheat Sheet

https://github.com/modelcontextprotocol/python-sdk

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.

Hi,

A security vulnerability has been fixed in Foreman, an open-source infrastructure lifecycle management tool.

CVE-2026-1961: Remote Code Execution via command injection in WebSocket proxy

A command injection vulnerability was discovered in Foreman's WebSocket proxy implementation. The vulnerability occurs when constructing shell commands using unsanitized hostname values from compute resource providers (such as VMware vSphere, Libvirt, etc.). An attacker operating a malicious compute resource server can achieve remote code execution on the Foreman server when an administrator accesses VM console functionality through the normal workflow.

Affected versions: Foreman up to and including 3.18.0

CVSS v3.1 Score: 8.0 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Fixed in: Foreman 3.18.1, Foreman 3.17.2, Foreman 3.16.3

Credit: Houssam Sahli

References: - Foreman security page: https://theforeman.org/security.html#2026-1961 - Redmine issue: https://projects.theforeman.org/issues/39121 - GitHub PR: https://github.com/theforeman/foreman/pull/10921

Thanks, Ondrej Gajdusek Foreman Project

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.

Summary: A critical command injection vulnerability exists in Foreman's WebSocket proxy implementation (lib/wsproxy.rb). The vulnerability occurs when constructing shell commands using unsanitized hostname values from compute resource providers. An attacker operating a malicious compute resource server (VMware vSphere, Libvirt, etc.) can achieve remote code execution on the Foreman server when an administrator accesses VM console functionality.

Requirements to exploit: An attacker needs to operate a malicious compute resource server (such as a fake vSphere server) that returns poisoned hostname values. The Foreman administrator must then configure this malicious server as a compute resource and attempt to access the VM console through the normal workflow.

Component affected: foreman

Version affected: Foreman <= 3.17.0 (confirmed), likely all versions from the past 4+ years (wsproxy.rb unchanged since 2020)

Patch available: Yes (need to be reviewed and verified)

Line 44 - Sanitize host parameter safehost = Shellwords.escape(host) Use array form to prevent shell injection cmdarray = [ 'websockify', '--daemon', "--idle-timeout=#{idletimeout}", "--timeout=#{timeout}", port.tos, "#{safehost}:#{hostport}" ] Add SSL options cmdarray += ['--ssl-target'] if ssltarget if Setting[:websocketsencrypt] cmdarray += ['--cert', Setting[:websocketssslcert]] if Setting[:websocketssslcert] cmdarray += ['--key', Setting[:websocketssslkey]] if Setting[:websocketssslkey] end Execute without shell interpretation Open3.popen3(cmdarray) do |stdin, stdout, stderr| # ... existing error handling End Version fixed (if any already): N/A

CVSS: Proposed by reporter - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Base Score: 8.8 High)

My understanding of the situation (6.8 Medium/High; Still serious, but not "internet critical" – CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Impact (optional): This vulnerability allows remote code execution as the foreman user, providing direct access to Foreman's database credentials and encryption keys. This enables decryption of all stored infrastructure credentials (vCenter, AWS, SSH keys, API tokens), allowing the attacker to pivot and compromise the entire managed infrastructure. Based on Red Hat's classification, this would be considered Critical impact due to the potential for complete infrastructure compromise. Embargo needed: Yes Reason: Given it is command injection Public date: Need to set default 90-days. There is no date received from the reporter.

Acknowledgement: Houssam Sahli

Steps to reproduce if available: 1. Start malicious vSphere server (attacker system): python3 maliciousvsphereserver.py 2. Configure Foreman compute resource (Foreman UI): - Navigate to: Infrastructure → Compute Resources → Create Compute Resource - Provider: VMware - VCenter/Server: <attackerip> (malicious server address) - Username: user - Password: pass - Load Datacenters (it will load EvilDatacenter) - Display Type: VNC - Uncheck "VNC Console Passwords" and "Enable Caching" - Click "Submit" 3. Trigger exploitation: - Navigate to Virtual Machines tab - Locate "TestVM" in the list - Click Actions → Console 4. Verify RCE (Foreman server): find /tmp -name "vsphererce.txt" 2>/dev/null cat /tmp/systemd-private-/tmp/vsphererce.txt Expected output: foreman

A command injection flaw was found in Red Hat Satellite 6.16.5.2 (Foreman 3.12.0.8-1). Although a whitelist for CoreOS Transpiler Command and Fedora CoreOS Transpiler Command is implemented, the whitelist is only enforced on the client-side and is not validated on the server-side. This flaw allows an authenticated user with editsettings permissions to modify these parameters to achieve arbitrary command execution on underlying operating system and bypass safe mode rendering.