CVE-2026-12540
published 2026-10-01CVE-2026-12540: A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an…
PriorityP349high8.2CVSS 3.1
AVLACLPRHUINSCCHIHAH
EPSS
1.20%
67.9th percentile
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
| redhat | satellite | >= 6.16 < 6.16.4 | 6.16.4 |
| redhat | satellite | >= 6.17 < 6.17.12 | 6.17.12 |
| redhat | satellite | >= 6.18 < 6.18.10 | 6.18.10 |
| redhat | satellite | >= 6.19 < 6.19.5 | 6.19.5 |
| satellite_el8 | foreman | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
vendor_redhat·2026-10-01·CVSS 8.2
CVE-2026-12540 [HIGH] CWE-78 foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Statement: Successful exploitation of this issue allows a restricted user to escalate privileges to the foreman user and subsequently to root across all managed hosts, organizations and locations. This represents a complete compromise of the
GHSA
A flaw was found in Foreman.
ghsa_unreviewed·2026-10-01
CVE-2026-12540 [HIGH] CWE-78 A flaw was found in Foreman.
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2026:74503https://access.redhat.com/errata/RHSA-2026:74504https://access.redhat.com/errata/RHSA-2026:74505https://access.redhat.com/errata/RHSA-2026:74506https://access.redhat.com/security/cve/CVE-2026-12540https://bugzilla.redhat.com/show_bug.cgi?id=2489969http://www.openwall.com/lists/oss-security/2026/10/07/9
2026-10-01
Published