Description
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Published: 2026-10-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Command Execution
Action: Apply Patch
AI Analysis

Impact

The foreman-tail utility in Foreman can be exploited by OS command injection. An attacker who gains local access can craft arguments that are used by eval without sanitization, allowing execution of arbitrary system commands. This flaw is classified as CWE-78 and could let the attacker modify system state, exfiltrate data, or fully compromise the host.

Affected Systems

Red Hat Satellite 6 and Red Hat Satellite 6.19 for RHEL 9 are impacted, including the satellite, satellite_capsule, and satellite_utils packages of version 6.19, where the vulnerable foreman-tail script resides.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, requiring an attacker to invoke foreman-tail with untrusted arguments. An attacker with local privileges on a system running the affected packages can exploit this weakness to execute arbitrary commands and potentially compromise the entire host.

Generated by OpenCVE AI on October 1, 2026 at 19:30 UTC.

Remediation

Vendor Workaround

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

OpenCVE Recommended Actions

  • Install the latest Red Hat Satellite 6 packages that contain the foreman-tail patch
  • Limit user permissions to prevent arbitrary execution of the foreman-tail utility
  • Restart the Foreman service to ensure the patched binary is in use
  • Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Generated by OpenCVE AI on October 1, 2026 at 19:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
CPEs cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Redhat enterprise Linux

Wed, 07 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
References

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Theforeman
Theforeman foreman
Vendors & Products Theforeman
Theforeman foreman

Fri, 02 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
References

Fri, 02 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 02 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_utils:6.18::el9
References

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Title Foreman: command injection in foreman-tail
First Time appeared Redhat
Redhat satellite
Redhat satellite Capsule
Redhat satellite Utils
Weaknesses CWE-78
CPEs cpe:/a:redhat:satellite:6
cpe:/a:redhat:satellite:6.19::el9
cpe:/a:redhat:satellite_capsule:6.19::el9
cpe:/a:redhat:satellite_utils:6.19::el9
Vendors & Products Redhat
Redhat satellite
Redhat satellite Capsule
Redhat satellite Utils
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Redhat Enterprise Linux Satellite Satellite Capsule Satellite Utils
Theforeman Foreman
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-07T06:12:06.548Z

Reserved: 2026-06-17T17:41:37.643Z

Link: CVE-2026-12542

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T18:17:15.033

Modified: 2026-10-16T13:19:24.893

Link: CVE-2026-12542

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-01T12:20:00Z

Links: CVE-2026-12542 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:57:54Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')