CVE-2026-12542

Foreman: command injection in foreman-tail

Published Oct 1, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Analysis

Technical impact

The foreman-tail utility in Foreman can be exploited by OS command injection. An attacker who gains local access can craft arguments that are used by eval without sanitization, allowing execution of arbitrary system commands. This flaw is classified as CWE-78 and could let the attacker modify system state, exfiltrate data, or fully compromise the host.

Affected Systems

Red Hat Satellite 6 and Red Hat Satellite 6.19 for RHEL 9 are impacted, including the satellite, satellite_capsule, and satellite_utils packages of version 6.19, where the vulnerable foreman-tail script resides.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, requiring an attacker to invoke foreman-tail with untrusted arguments. An attacker with local privileges on a system running the affected packages can exploit this weakness to execute arbitrary commands and potentially compromise the entire host.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Red Hat

Red Hat Satellite 6.16 for RHEL 8

affected

Version	Status	Constraints
`0:3.12.0.23-1.el8sat`	unaffected	< *

Red Hat

Red Hat Satellite 6.16 for RHEL 9

affected

Version	Status	Constraints
`0:3.12.0.23-1.el9sat`	unaffected	< *

Red Hat

Red Hat Satellite 6.17 for RHEL 9

affected

Version	Status	Constraints
`0:3.14.0.22-1.el9sat`	unaffected	< *

Red Hat

Red Hat Satellite 6.18 for RHEL 9

affected

Version	Status	Constraints
`0:3.16.0.25-1.el9sat`	unaffected	< *

Red Hat

Red Hat Satellite 6.19 for RHEL 9

affected

Version	Status	Constraints
`0:3.18.0.14-1.el9sat`	unaffected	< *

Red Hat Red Hat Satellite 6 affected —

Configuration 1 [-]

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR	cpe:2.3:a:theforeman:foreman::::::::
	cpe:2.3:a:theforeman:foreman:5.0.0:::::::*

Configuration 5 [-]

AND

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 6 [-]

cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Satellite 6.16 for RHEL 8
foreman-0:3.12.0.23-1.el8sat	cpe:/a:redhat:satellite_utils:6.16::el8	RHSA-2026:74506	2026-10-01T00:00:00Z
Red Hat Satellite 6.16 for RHEL 9
foreman-0:3.12.0.23-1.el9sat	cpe:/a:redhat:satellite_utils:6.16::el9	RHSA-2026:74506	2026-10-01T00:00:00Z
Red Hat Satellite 6.18 for RHEL 9
foreman-0:3.16.0.25-1.el9sat	cpe:/a:redhat:satellite_utils:6.18::el9	RHSA-2026:74504	2026-10-01T00:00:00Z
Red Hat Satellite 6.19 for RHEL 9
foreman-0:3.18.0.14-1.el9sat	cpe:/a:redhat:satellite_utils:6.19::el9	RHSA-2026:74503	2026-10-01T00:00:00Z

Vendor Product Versions

Redhat

Satellite

Version	Status	Scheme	Platform
`—`	affected	—	—

Theforeman

Foreman

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

OpenCVE Recommended Actions

Install the latest Red Hat Satellite 6 packages that contain the foreman-tail patch
Limit user permissions to prevent arbitrary execution of the foreman-tail utility
Restart the Foreman service to ensure the patched binary is in use
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Generated by OpenCVE AI on October 1, 2026 at 19:30 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.563% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/10/07/7
https://access.redhat.com/errata/RHSA-2026:74503
https://access.redhat.com/errata/RHSA-2026:74504
https://access.redhat.com/errata/RHSA-2026:74505
https://access.redhat.com/errata/RHSA-2026:74506
https://access.redhat.com/security/cve/CVE-2026-12542
https://bugzilla.redhat.com/show_bug.cgi?id=2489971
https://nvd.nist.gov/vuln/detail/CVE-2026-12542
https://www.cve.org/CVERecord?id=CVE-2026-12542

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 16, 2026 1:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat enterprise Linux
CPEs		cpe:2.3:a:redhat:satellite:::::::: cpe:2.3:a:redhat:satellite:6.0:::::::* cpe:2.3:a:theforeman:foreman:::::::: cpe:2.3:a:theforeman:foreman:5.0.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
Vendors & Products		Redhat enterprise Linux

Oct 7, 2026 7:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/07/7

Oct 4, 2026 10:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Theforeman Theforeman foreman
Vendors & Products		Theforeman Theforeman foreman

Oct 2, 2026 6:00 PM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:satellite:6.17::el9 cpe:/a:redhat:satellite_capsule:6.17::el9 cpe:/a:redhat:satellite_utils:6.17::el9
References		https://access.redhat.com/errata/RHSA-2026:74505

Oct 2, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12542 https://www.cve.org/CVERecord?id=CVE-2026-12542
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 2, 2026 12:00 AM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite:6.18::el9 cpe:/a:redhat:satellite_capsule:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el9 cpe:/a:redhat:satellite_capsule:6.18::el9 cpe:/a:redhat:satellite_utils:6.16::el8 cpe:/a:redhat:satellite_utils:6.16::el9 cpe:/a:redhat:satellite_utils:6.18::el9
References		https://access.redhat.com/errata/RHSA-2026:74504 https://access.redhat.com/errata/RHSA-2026:74506

Oct 1, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, \|) to execute arbitrary system commands.
Title		Foreman: command injection in foreman-tail
First Time appeared		Redhat Redhat satellite Redhat satellite Capsule Redhat satellite Utils
Weaknesses		CWE-78
CPEs		cpe:/a:redhat:satellite:6 cpe:/a:redhat:satellite:6.19::el9 cpe:/a:redhat:satellite_capsule:6.19::el9 cpe:/a:redhat:satellite_utils:6.19::el9
Vendors & Products		Redhat Redhat satellite Redhat satellite Capsule Redhat satellite Utils
References		https://access.redhat.com/errata/RHSA-2026:74503 https://access.redhat.com/security/cve/CVE-2026-12542 https://bugzilla.redhat.com/show_bug.cgi?id=2489971
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}`