Hi,

A security fix has been released in Hammer CLI, a command-line interface for Foreman.

CVE-2026-12545: Hammer CLI: editor command injection

A local attacker who can influence Hammer CLI's editor configuration can cause commands to execute when a user invokes the affected editor flow. If Hammer CLI runs with elevated privileges, this can result in privilege escalation.

Affected versions: Hammer CLI 0.15.1 through 3.19.0, and 5.0.0 CVSS: 6.7 (Moderate) CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Fixed versions: Hammer CLI 3.19.1 and 5.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12545 - Redmine: https://projects.theforeman.org/issues/39842 - Fix: https://github.com/theforeman/hammer-cli/pull/407

Thanks, Ondrej Gajdusek Foreman Release Team

rubygem-hammercliforeman: File /etc/hammer/cli.modules.d/foreman.yml world readable

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.