CVE-2026-12544

Analyzed Analyzed - Analysis Complete

Server-Side Template Injection in Foreman

Publication date: 2026-10-01

Last updated on: 2026-10-08

Assigner: redhat-SADP

Description

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-12544

EUVD

EUVD-2026-90919

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	satellite	6.0
redhat	satellite	From 6.16 (inc) to 6.16.4 (exc)
redhat	satellite	From 6.17 (inc) to 6.17.12 (exc)
redhat	satellite	From 6.19 (inc) to 6.19.5 (exc)
theforeman	foreman	*
redhat	satellite	From 6.18 (inc) to 6.18.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-12544 is a flaw in Foreman's foreman-rake initialization logic in /usr/share/foreman/config/settings.rb. It involves a multi-stage execution chain where configuration data is processed through two executable layers, enabling both Server-Side Template Injection (SSTI) and insecure deserialization. This can lead to remote code execution and total infrastructure compromise.

Detection Guidance

Check for suspicious files in configuration directories like /etc/foreman-maintain/foreman_maintain.yml and /usr/share/foreman/config/settings.plugins.d/. Look for unexpected code execution patterns such as <%= ... %> tags in YAML files or malicious plugin configurations.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code remotely with high privileges, often as the foreman or root user. Compromising the Satellite server could let attackers pivot and execute code across all managed hosts. It may also enable supply chain attacks if malicious plugins or configurations are distributed through public repositories.

Compliance Impact

This vulnerability could lead to unauthorized code execution and data breaches, which may violate compliance requirements under GDPR and HIPAA. Compromised systems could expose sensitive data, leading to legal and regulatory penalties.

Mitigation Strategies

Update the Foreman package immediately as Red Hat advises. Replace YAML.load with YAML.safe_load in the codebase and remove ERB template evaluation to prevent code execution in configuration files.

Hi! I’m here to help you understand CVE-2026-12544. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70