CVE-2026-96658

Modified Modified - Updated After Analysis

Remote Code Execution in Foreman via Templating Engine Bypass

Publication date: 2026-10-01

Last updated on: 2026-10-18

Assigner: redhat-SADP

Description

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96658

EUVD

EUVD-2026-90921

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	satellite	From 6.16 (inc) to 6.16.4 (exc)
redhat	satellite	From 6.17 (inc) to 6.17.12 (exc)
redhat	satellite	From 6.19 (inc) to 6.19.5 (exc)
theforeman	foreman	5.0.0
theforeman	foreman	to 2.0.1 (exc)
theforeman	foreman	3.19.0
theforeman	foreman	3.19.1
redhat	satellite	From 6.18 (inc) to 6.18.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a safemode bypass flaw in Foreman, a component of Red Hat Satellite. An authenticated attacker with low-level permissions can achieve remote code execution by exploiting improper handling of delegated methods in the templating engine. They append unauthorized functions to the allowed execution list, enabling arbitrary command execution on the hosting server.

Detection Guidance

Detecting this vulnerability requires checking Foreman versions and reviewing templating engine logs for suspicious activity. Use commands like 'rpm -q foreman' to verify installed versions and inspect Safemode bypass attempts in template rendering logs. Security scanners compatible with Red Hat's backporting practices can also help identify affected systems.

Impact Analysis

An attacker with minimal read permissions could execute arbitrary code on the Satellite server, potentially leading to full system compromise. This includes unauthorized data access, modification, or deletion, and could disrupt services. The high CVSS score (9.9) indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information). Organizations using Foreman may face legal penalties, reputational damage, and loss of certification if exploited.

Mitigation Strategies

Immediately upgrade Foreman to the latest patched version. If upgrading is not possible, apply mitigations provided by Red Hat or consult a Technical Account Manager. Restrict user permissions to the minimum required and monitor for unauthorized template execution attempts.

Hi! I’m here to help you understand CVE-2026-96658. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70