CVE-2026-12540 Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
An attacker with sudo permissions can execute arbitrary code via command injection in the foreman-rake errors:fetch_log task.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12540?
CVE-2026-12540 is a high-severity command injection vulnerability in Redhat Satellite, published on 1 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Weakness: CWE-78
Which versions are affected by CVE-2026-12540?
It affects 2 products.
Products include Redhat Satellite, Theforeman Foreman.
How do I fix CVE-2026-12540?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-12540 being exploited?
There is no known exploitation of CVE-2026-12540 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-c5q9-9fc7-jgxp.