← Back

CVE-2026-12544

nvd nist
Published: Oct 1, 2026Modified: Oct 8, 2026

JSON object

Loading...
7.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Exploitability: 1.1 / Impact: 6.0
Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Affected (6)

Redhat
1 product
Satellite
Theforeman
1 product
Foreman
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Satellite
Version 6.0
Configuration B
1 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Satellite
6.16 ≤ version < 6.16.4
Running on/withPlatform Versions
Redhat
Enterprise Linux
Version 8.0
Redhat
Enterprise Linux
Version 9.0
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Satellite
6.17 ≤ version < 6.17.12
Running on/withPlatform Versions
Redhat
Enterprise Linux
Version 9.0
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Satellite
6.19 ≤ version < 6.19.5
Running on/withPlatform Versions
Redhat
Enterprise Linux
Version 9.0
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Foreman
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Satellite
6.18 ≤ version < 6.18.10
Running on/withPlatform Versions
Redhat
Enterprise Linux
Version 9.0

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (7)

Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.