EUVD-2026-90921
GHSA-g2wg-rx2f-4j5r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable templating engine, low complexity, requires a low-privilege authenticated account (PR:L); sandbox escape to host code execution changes scope (S:C) with full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
AnalysisAI
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only low-level permissions to bypass the safemode sandbox in the provisioning/report templating engine and execute arbitrary commands on the management host, carrying a vendor score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is authenticated (CVSS vector PR:L) and requires the ability to author or render templates; the scope-changed impact is severe because a successful escape yields control of the Satellite/Foreman management server, not just the template context, but the prerequisite of valid credentials plus template privileges means the 9.9 rating overstates how easily the issue is reached in hardened deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Foreman/Red Hat Satellite account with at least low-level permissions that permit interacting with the templating engine (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority within environments that run the affected product, though the raw 9.9 score overstates the ease of exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply Red Hat errata RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), which is the authoritative fix for Satellite 6.19 for RHEL 9; consult the errata for the exact updated package versions and also track the advisory page at https://access.redhat.com/security/cve/CVE-2026-96658 and Bugzilla 2534185 for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm all Foreman and Red Hat Satellite 6.19 for RHEL 9 instances, restrict provisioning/report template authoring and rendering permissions to the smallest trusted administrator group, audit accounts with template privileges, enable detailed logging, and review recent template changes or command execution for signs of abuse. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management perm
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today