An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.

A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12423: Foreman: provisioning token validation flaw

An unauthenticated request can reach build-host provisioning through an IP/MAC fallback when no valid provisioning token is supplied. The fallback is reachable in token-enabled Red Hat-family provisioning configurations and can expose provisioning data.

Affected versions: Foreman 1.1 through 3.19.1, and 5.0.0 CVSS: 7.5 (Important) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12423 - Redmine: https://projects.theforeman.org/issues/39837 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetchlog

A user allowed to run the restricted foreman-rake log task can cause command execution through its request identifier parameter. Unsafe shell handling can compromise the Foreman server.

Affected versions: Foreman 2.2.0 through 3.19.1, and 5.0.0 CVSS: 8.2 (Important) CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12540 - Redmine: https://projects.theforeman.org/issues/39838 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12541: Foreman: command injection in foreman-rake database tasks

A user allowed to run restricted foreman-rake database tasks can cause command execution through file path parameters. Unsafe shell handling can compromise the Foreman server and its database.

Affected versions: Foreman 1.5.0 through 3.19.1, and 5.0.0 CVSS: 8.2 (Important) CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12541 - Redmine: https://projects.theforeman.org/issues/39839 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12542: Foreman: command injection in foreman-tail

A local user with access to foreman-tail can inject commands because user input is evaluated unsafely. Successful exploitation allows arbitrary command execution on the Foreman server.

Affected versions: Foreman 1.5.0 through 3.19.1, and 5.0.0 CVSS: 5.3 (Moderate) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12542 - Redmine: https://projects.theforeman.org/issues/39840 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration

An attacker who can influence Foreman configuration can trigger server-side template evaluation or unsafe deserialization during foreman-rake startup, leading to code execution in a privileged service context.

Affected versions: Foreman 1.0 through 3.19.1, and 5.0.0; the ERB execution path starts at 1.15.0 CVSS: 7.7 (Important) CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12544 - Redmine: https://projects.theforeman.org/issues/39841 - Fix: https://github.com/theforeman/foreman/pull/11310

Thanks, Ondrej Gajdusek Foreman Release Team

Hi,

A security fix has been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-96658: Foreman: Safemode bypass leading to RCE

A low-privilege user permitted to render supplied template content can bypass Foreman's Safemode restrictions and reach Ruby code execution with Foreman service privileges.

Affected versions: Foreman releases bundling Safemode before 2.0.1, including Foreman 3.19.0, 3.19.1, and 5.0.0 CVSS: 9.9 (Critical) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Fixed versions: Foreman 3.19.2 and 5.0.1; Safemode 2.0.1 or later must be installed Credit: Robb Gatica

References: - Foreman Security: https://theforeman.org/security.html#2026-96658 - Redmine: https://projects.theforeman.org/issues/39845 - Fix: https://github.com/theforeman/safemode/pull/68 - Dependency update: https://github.com/theforeman/safemode/pull/69

Thanks, Ondrej Gajdusek Foreman Release Team

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.

When accessing certain API endpoints (e.g. POSTing to /template/preview) a user with the Viewer role is able to access information they should not be able to (i.e. @host.rootpass). When the system is configured insecurely (i.e. Safemode is disabled), or a Safemode bypass vulnerability exists, then the Viewer is able to perform Remote Code Execution on the system as the foreman system account.

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

A Safemode bypass attack has been identified that exposes a number of weaknesses in Foreman leading to low-privilege (i.e. minimum "view" permissions) to be able to perform limited Remote Code Execution (RCE). It appears that a copy of the delegatemethods to the local scope allows an adversary to append eval to the permitted methods list leveraged by safemode, thus permitting RCE through the templating engine.

Hi,

Multiple security fixes have been released in Foreman, an open-source lifecycle management tool for physical and virtual servers.

---

CVE-2026-5136: Foreman: Privilege escalation via usergroup role assignment manipulation

The Usergroup model does not validate whether the calling user is permitted to assign the specified roles. A user with createusergroups or editusergroups permission can attach arbitrary roles to a usergroup via the API, add themselves as a member, and inherit elevated privileges.

Affected versions: all Foreman versions CVSS: 8.8 (Important) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5136 - Redmine: https://projects.theforeman.org/issues/39478 - Fix: https://github.com/theforeman/foreman/pull/11066

---

CVE-2026-5142: Foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass

The KeyPairsController#show action is excluded from the findcomputeresource callback that enforces taxonomy scoping. An authenticated user with the viewkeypairs permission can download the full PEM private key of any compute resource by database ID, bypassing organization and location boundaries.

Affected versions: all Foreman versions since 1.15.0 CVSS: 6.5 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5142 - Redmine: https://projects.theforeman.org/issues/39479 - Fix: https://github.com/theforeman/foreman/pull/11069

---

CVE-2026-5135: Foreman: Unauthorized modification of host configurations via broken access control

When lookup values are submitted as nested attributes during host or hostgroup updates, the match field is permitted and applied without ownership validation. A user with host-edit rights can retarget an existing lookup value override to point at a different host, injecting configuration values into hosts they are not authorized to edit.

Affected versions: all Foreman versions CVSS: 6.5 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5135 - Redmine: https://projects.theforeman.org/issues/39480 - Fix: https://github.com/theforeman/foreman/pull/11072

---

CVE-2026-5138: Foreman: Information disclosure via improper validation of nested request parameters

The taxonomyscope controller method loads organization and location IDs from nested request parameters without checking the user's taxonomy membership. An authenticated user with host-edit permissions can supply a foreign organization ID in nested parameters to scope AJAX queries to a tenant they do not belong to, leaking infrastructure metadata such as domains, subnets, and IP availability.

Affected versions: all Foreman versions since 1.7.0 CVSS: 4.3 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Fixed versions: 3.18.2, 3.19.1 Credit: Stanislav Fot (Aisle Research)

References: - Foreman Security: https://theforeman.org/security.html#2026-5138 - Redmine: https://projects.theforeman.org/issues/39481 - Fix: https://github.com/theforeman/foreman/pull/11075

---

Thanks, Ondrej Gajdusek Foreman Release Team

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Description

The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a Multi-Stage Execution Chain that allows for both Server-Side Template Injection (SSTI) and Insecure Deserialization.

The vulnerability execution chain has two stages:

Template Injection (ERB): The first stage uses ERB.new(...).result. This evaluates the file as a Ruby template. Any code inside <%= ... %> is executed by the Ruby interpreter to generate a string. This is an SSTI that allows for direct OS command injection.

Insecure Deserialization (YAML): The second stage takes the rendered string and passes it to YAML.load. Because this is an unsafe parser, it allows for object injection. Even if an attacker cannot use ERB tags, they can craft YAML that instantiates malicious Ruby "gadget chains" to achieve code execution.

The vulnerability exists in two different application functionalities, thus it can be exploited in two different ways:

Primary config:

SETTINGS.merge! YAML.load(ERB.new(File.read(settingsfile)).result) allows an attacker to craft a malicious /etc/foreman-maintain/foremanmaintain.yml file that will be loaded and executed by foreman-rake on start.

Plugins config:

SETTINGS.merge! YAML.load(ERB.new(File.read(f)).result) allows an attacker to craft a malicious file that will be executed from /usr/share/foreman/config/settings.plugins.d/ by foreman-rake on start.

Impact

Indirect Triggering & Privileged RCE: foreman-rake exposes underlying execution primitives that higher-level orchestration tools (like foreman-maintain or foreman-installer) rely on to interact with the application. Because these tools implicitly pass commands down, the vulnerability can be triggered indirectly during routine administrative operations, resulting in Remote Code Execution (RCE) in a high-trust context (often foreman or root).

Total Infrastructure Compromise: Compromising the management plane (Satellite server) allows an attacker to pivot and execute arbitrary code across all Satellite Managed Hosts.

Supply Chain Risk: While direct local exploitation requires prior root access, this flaw presents a critical supply chain risk. An adversary could distribute malicious plugins or compromised configuration files through public repositories (e.g., RubyGems, GitHub). Note: The CVSS vector and severity are based on this supply chain attack vector.

RECOMMENDATIONS

Replace YAML.load with YAML.safeload(content, permittedclasses: [Symbol]) in both locations in settings.rb.

Remove the ERB.new().result evaluation. Configuration files must be treated as static data, never as executable templates.

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's validhosttoken? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.

Hi,

A security vulnerability has been fixed in Foreman, an open-source infrastructure lifecycle management tool.

CVE-2026-1961: Remote Code Execution via command injection in WebSocket proxy

A command injection vulnerability was discovered in Foreman's WebSocket proxy implementation. The vulnerability occurs when constructing shell commands using unsanitized hostname values from compute resource providers (such as VMware vSphere, Libvirt, etc.). An attacker operating a malicious compute resource server can achieve remote code execution on the Foreman server when an administrator accesses VM console functionality through the normal workflow.

Affected versions: Foreman up to and including 3.18.0

CVSS v3.1 Score: 8.0 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Fixed in: Foreman 3.18.1, Foreman 3.17.2, Foreman 3.16.3

Credit: Houssam Sahli

References: - Foreman security page: https://theforeman.org/security.html#2026-1961 - Redmine issue: https://projects.theforeman.org/issues/39121 - GitHub PR: https://github.com/theforeman/foreman/pull/10921

Thanks, Ondrej Gajdusek Foreman Project

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.

Summary: A critical command injection vulnerability exists in Foreman's WebSocket proxy implementation (lib/wsproxy.rb). The vulnerability occurs when constructing shell commands using unsanitized hostname values from compute resource providers. An attacker operating a malicious compute resource server (VMware vSphere, Libvirt, etc.) can achieve remote code execution on the Foreman server when an administrator accesses VM console functionality.

Requirements to exploit: An attacker needs to operate a malicious compute resource server (such as a fake vSphere server) that returns poisoned hostname values. The Foreman administrator must then configure this malicious server as a compute resource and attempt to access the VM console through the normal workflow.

Component affected: foreman

Version affected: Foreman <= 3.17.0 (confirmed), likely all versions from the past 4+ years (wsproxy.rb unchanged since 2020)

Patch available: Yes (need to be reviewed and verified)

Line 44 - Sanitize host parameter safehost = Shellwords.escape(host) Use array form to prevent shell injection cmdarray = [ 'websockify', '--daemon', "--idle-timeout=#{idletimeout}", "--timeout=#{timeout}", port.tos, "#{safehost}:#{hostport}" ] Add SSL options cmdarray += ['--ssl-target'] if ssltarget if Setting[:websocketsencrypt] cmdarray += ['--cert', Setting[:websocketssslcert]] if Setting[:websocketssslcert] cmdarray += ['--key', Setting[:websocketssslkey]] if Setting[:websocketssslkey] end Execute without shell interpretation Open3.popen3(cmdarray) do |stdin, stdout, stderr| # ... existing error handling End Version fixed (if any already): N/A

CVSS: Proposed by reporter - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Base Score: 8.8 High)

My understanding of the situation (6.8 Medium/High; Still serious, but not "internet critical" – CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Impact (optional): This vulnerability allows remote code execution as the foreman user, providing direct access to Foreman's database credentials and encryption keys. This enables decryption of all stored infrastructure credentials (vCenter, AWS, SSH keys, API tokens), allowing the attacker to pivot and compromise the entire managed infrastructure. Based on Red Hat's classification, this would be considered Critical impact due to the potential for complete infrastructure compromise. Embargo needed: Yes Reason: Given it is command injection Public date: Need to set default 90-days. There is no date received from the reporter.

Acknowledgement: Houssam Sahli

Steps to reproduce if available: 1. Start malicious vSphere server (attacker system): python3 maliciousvsphereserver.py 2. Configure Foreman compute resource (Foreman UI): - Navigate to: Infrastructure → Compute Resources → Create Compute Resource - Provider: VMware - VCenter/Server: <attackerip> (malicious server address) - Username: user - Password: pass - Load Datacenters (it will load EvilDatacenter) - Display Type: VNC - Uncheck "VNC Console Passwords" and "Enable Caching" - Click "Submit" 3. Trigger exploitation: - Navigate to Virtual Machines tab - Locate "TestVM" in the list - Click Actions → Console 4. Verify RCE (Foreman server): find /tmp -name "vsphererce.txt" 2>/dev/null cat /tmp/systemd-private-/tmp/vsphererce.txt Expected output: foreman

A command injection flaw was found in Red Hat Satellite 6.16.5.2 (Foreman 3.12.0.8-1). Although a whitelist for CoreOS Transpiler Command and Fedora CoreOS Transpiler Command is implemented, the whitelist is only enforced on the client-side and is not validated on the server-side. This flaw allows an authenticated user with editsettings permissions to modify these parameters to achieve arbitrary command execution on underlying operating system and bypass safe mode rendering.

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

A potential XSS issue within Foreman / Katello has been reported. It is possible to inject JavaScript code into the Description field of a User and save it. This code is then executed when opening certain pages (e.g., Host Collections).