EUVD-2026-90919
GHSA-q8r6-95rf-344m
Severity by source
AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Requires privileged write access to Foreman config processed by foreman-rake, so PR:H and AV:L with UI:R; scope changes (S:C) as RCE compromises managed infrastructure with full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
AnalysisAI
Privileged local attackers who can control Foreman configuration data can chain server-side template injection with insecure deserialization through the foreman-rake initialization logic in /usr/share/foreman/config/settings.rb to execute arbitrary code on Red Hat Satellite 6.19 for RHEL 9 hosts, resulting in full host compromise and downstream supply chain risk. The assessed CVSS 3.1 vector (7.7, AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) confirms the attack is local and authenticated with high privileges plus a user-interaction component, so it is not remotely or unauthenticated reachable against a default deployment and real exposure is largely confined to compromised or malicious privileged operators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker with privileged, local control over Foreman configuration data that passes through the foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, where values are evaluated across two executable layers enabling SSTI and insecure deserialization (CWE-502). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority, not a drop-everything, issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Red Hat has released a vendor advisory, RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), so the primary action is to apply that errata to affected Red Hat Satellite 6.19 for RHEL 9 installations; patch availability is confirmed by the advisory rather than by a specific fix version in the supplied data, so consult the errata for exact corrected package versions before scheduling maintenance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether Red Hat errata RHSA-2026:74503 applies to your Red Hat Satellite 6.19 for RHEL 9 hosts and deploy it under emergency change control if available; note that no vendor-released patch identified at time of analysis per the structured patch status, while the description references RHSA-2026:74503 as addressing the issue, so validate applicability directly with Red Hat. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today