Description
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
Published: 2026-10-01
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

The flaw resides in the Foreman initialization logic for the foreman‑rake tool, where configuration data is processed through two executable layers. This multi‑stage execution chain enables Server‑Side Template Injection and insecure deserialization, both of which can lead to remote code execution and total infrastructure compromise, presenting a supply chain risk.

Affected Systems

Red Hat Satellite 6, including Satellite 6.19 for RHEL 9, and the Satellite 6.19 capsule and utilities packages for RHEL 9 are affected. The vulnerability exists in the foreman‑rake configuration directory under /usr/share/foreman/config/settings.rb.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector involves sending crafted configuration data to the foreman‑rake initializer over the network, allowing an attacker to execute arbitrary code on the host where the foreman services run.

Generated by OpenCVE AI on October 1, 2026 at 18:15 UTC.

Remediation

Vendor Workaround

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

OpenCVE Recommended Actions

  • Apply the Red Hat security update RHSA‑2026:74503 to upgrade the foreman‑rake package to the fixed version.
  • Follow the CNA's workaround: update the affected package as soon as possible.
  • Restart the Foreman services or reboot the system so the updated code is loaded immediately.
  • Restrict write permissions to the foreman configuration directories to prevent unauthorized modifications.

Generated by OpenCVE AI on October 1, 2026 at 18:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
CPEs cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Redhat enterprise Linux

Wed, 07 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
References

Fri, 02 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
References

Fri, 02 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 01 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite_utils:6.18::el9
References

Thu, 01 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Theforeman
Theforeman foreman
Vendors & Products Theforeman
Theforeman foreman

Thu, 01 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
Title Foreman: ssti and insecure deserialization in foreman-rake configuration
First Time appeared Redhat
Redhat satellite
Redhat satellite Capsule
Redhat satellite Utils
Weaknesses CWE-502
CPEs cpe:/a:redhat:satellite:6.19::el9
cpe:/a:redhat:satellite_capsule:6.19::el9
cpe:/a:redhat:satellite_utils:6.19::el9
Vendors & Products Redhat
Redhat satellite
Redhat satellite Capsule
Redhat satellite Utils
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Satellite Satellite Capsule Satellite Utils
Theforeman Foreman
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-07T06:12:07.645Z

Reserved: 2026-06-17T17:42:09.510Z

Link: CVE-2026-12544

cve-icon Vulnrichment

Updated: 2026-10-07T06:12:07.645Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T17:17:20.340

Modified: 2026-10-08T13:15:52.740

Link: CVE-2026-12544

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-01T12:20:00Z

Links: CVE-2026-12544 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T19:33:44Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data