CVE-2026-12544
Received Received - Intake

Server-Side Template Injection in Foreman

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: redhat-SADP

Description
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-12544
EUVD
EUVD-2026-90919

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
foreman foreman *
red_hat foreman *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-12544 is a flaw in Foreman's foreman-rake initialization logic in /usr/share/foreman/config/settings.rb. It involves a multi-stage execution chain where configuration data is processed through two executable layers, enabling both Server-Side Template Injection (SSTI) and insecure deserialization. This can lead to remote code execution and total infrastructure compromise.

Detection Guidance

Check for suspicious files in configuration directories like /etc/foreman-maintain/foreman_maintain.yml and /usr/share/foreman/config/settings.plugins.d/. Look for unexpected code execution patterns such as <%= ... %> tags in YAML files or malicious plugin configurations.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code remotely with high privileges, often as the foreman or root user. Compromising the Satellite server could let attackers pivot and execute code across all managed hosts. It may also enable supply chain attacks if malicious plugins or configurations are distributed through public repositories.

Compliance Impact

This vulnerability could lead to unauthorized code execution and data breaches, which may violate compliance requirements under GDPR and HIPAA. Compromised systems could expose sensitive data, leading to legal and regulatory penalties.

Mitigation Strategies

Update the Foreman package immediately as Red Hat advises. Replace YAML.load with YAML.safe_load in the codebase and remove ERB template evaluation to prevent code execution in configuration files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart