EUVD-2026-90916
GHSA-c5q9-9fc7-jgxp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires local access and a high-privilege sudo grant to run the rake task (AV:L, PR:H); injection trivially escapes grep (AC:L), and escaping the sudo boundary to full code execution justifies S:C with C/I/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
AnalysisAI
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker who already holds a sudo grant permitting execution of the specific foreman-rake errors:fetch_log task on a Red Hat Satellite 6 / Foreman host; the request_id parameter must be attacker-controllable and is passed to an underlying shell command (typically grep) without adequate neutralization, so injected metacharacters (;, ", |) escape the intended command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a privilege-escalation-to-RCE flaw rather than a remotely exploitable one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Red Hat vendor fix delivered via errata RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), which addresses the inadequate shell neutralization in the foreman-rake errors:fetch_log task; consult the CVE page https://access.redhat.com/security/cve/CVE-2026-12540 for the exact patched package versions for Satellite 6 and the 6.19-for-RHEL-9 stream. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Satellite 6 and standalone Foreman host and enumerate which accounts hold sudo privileges scoped to the foreman-rake errors:fetch_log task (audit /etc/sudoers and /etc/sudoers.d for entries referencing foreman-rake or rake task grants), then temporarily suspend or tighten those grants unless operationally essential; confirm no unauthorized accounts hold the privilege and enable verbose logging of sudo invocations of foreman-rake for review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today