All vulnerabilities
CVE-2026-12540

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Red Hat Red Hat Satellite 6.16 for RHEL 8Operating systems
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.20%Chance of exploitation activity in the next 30 days, higher than 67% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published1 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

Text from CVE List

Affected versions 5

  • Red Hat Satellite 6.16 for RHEL 8unaffected: 0:3.12.0.23-1.el8sat and laterCVE List
  • Red Hat Satellite 6.16 for RHEL 9unaffected: 0:3.12.0.23-1.el9sat and laterCVE List
  • Red Hat Satellite 6.17 for RHEL 9unaffected: 0:3.14.0.22-1.el9sat and laterCVE List
  • Red Hat Satellite 6.18 for RHEL 9unaffected: 0:3.16.0.25-1.el9sat and laterCVE List
  • Red Hat Satellite 6.19 for RHEL 9unaffected: 0:3.18.0.14-1.el9sat and laterCVE List

References 6