EUVD-2026-90918
GHSA-rcq3-9wpf-p347
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires existing delegated rights to run foreman-rake so PR:H and AV:L; trivial metacharacter injection gives AC:L, and escaping sudo confinement to full OS execution justifies S:C with C/I/A all High.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
AnalysisAI
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess permission to execute the foreman-rake `db:dump` or `db:import_dump` tasks - the description names a restricted sudo configuration as the enabling path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Red Hat vendor fix for this flaw via RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), which updates Foreman/Satellite components; patch available per vendor advisory - an exact fixed package version was not independently confirmed from the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, treat CVE-2026-12541 as unpatched and reduce exposure by auditing every sudo delegation, policy or automation grant that allows non-root accounts to invoke foreman-rake db:dump or db:import_dump on Red Hat Satellite 6.19 for RHEL 9 and any other Satellite 6 hosts, and remove or tighten those delegations where the business does not strictly require them; confirm where foreman-rake is executed only by root with no restricted sudo delegation, since those environments are effectively not exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today