CVE-2026-12541
published 2026-10-01CVE-2026-12541: A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly…
PriorityP350high8.2CVSS 3.1
AVLACLPRHUINSCCHIHAH
EPSS
1.20%
67.9th percentile
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
| redhat | satellite | >= 6.16 < 6.16.4 | 6.16.4 |
| redhat | satellite | >= 6.17 < 6.17.12 | 6.17.12 |
| redhat | satellite | >= 6.18 < 6.18.10 | 6.18.10 |
| redhat | satellite | >= 6.19 < 6.19.5 | 6.19.5 |
| satellite_el8 | foreman | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in Foreman.
ghsa_unreviewed·2026-10-01
CVE-2026-12541 [HIGH] CWE-78 A flaw was found in Foreman.
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Red Hat
foreman: command injection in foreman-rake database tasks
vendor_redhat·2026-10-01·CVSS 8.2
CVE-2026-12541 [HIGH] CWE-78 foreman: command injection in foreman-rake database tasks
foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Statement: Successful exploitation of this issue allows a restricted user to escalate privileges to the foreman account and execute arbitrary commands. This grants control over the Satellite database and configurations, enabling lateral movement
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2026:74503https://access.redhat.com/errata/RHSA-2026:74504https://access.redhat.com/errata/RHSA-2026:74505https://access.redhat.com/errata/RHSA-2026:74506https://access.redhat.com/security/cve/CVE-2026-12541https://bugzilla.redhat.com/show_bug.cgi?id=2489970http://www.openwall.com/lists/oss-security/2026/10/07/8
2026-10-01
Published