EUVD-2026-90969
GHSA-79jg-9wx4-f5rr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Local-only utility invocation (AV:L) by an existing low-privileged user (PR:L), trivial unsanitized injection (AC:L), with command execution bounded to the invoking user's privileges (impacts Low, S:U).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
AnalysisAI
OS command injection in Foreman's foreman-tail utility, as shipped in Red Hat Satellite 6 (including Satellite 6.19 for RHEL 9), lets a local low-privileged user execute arbitrary shell commands by supplying arguments containing shell metacharacters such as ;, &, or |. Exploitation requires local access to a host running the affected Satellite/Foreman installation and the ability to invoke foreman-tail with attacker-controlled arguments (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 5.3); there is no remote or unauthenticated path, and the Unchanged scope with uniformly Low impacts indicates commands run at the invoking user's privilege rather than escalating. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a host running Red Hat Satellite 6 (or 6.19 for RHEL 9) and the ability to invoke the foreman-tail utility with attacker-controlled arguments; the injected shell metacharacters (;, &, |) are passed unsanitized into an eval used for file-path expansion. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity, locally-exploitable OS command injection (CWE-78) in Foreman's foreman-tail utility, as shipped in Red Hat Satellite 6. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix from Red Hat errata RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), which is the authoritative remediation for Red Hat Satellite 6 and Satellite 6.19 for RHEL 9; patch status is 'Patch available per vendor advisory' and no independent patched version number was confirmed in the supplied data, so verify the fixed package build in the errata before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today