CVE-2026-12544 Foreman: ssti and insecure deserialization in foreman-rake configuration

High 7.7 Published 1 Oct 2026 Updated 7 Oct 2026

Attackers can achieve remote code execution and infrastructure compromise via insecure deserialization and SSTI in Foreman configuration processing.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-12544?

CVE-2026-12544 is a high-severity unsafe deserialization vulnerability in Redhat Satellite, published on 1 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Weakness: CWE-502

Which versions are affected by CVE-2026-12544?

It affects 2 products.

Products include Redhat Satellite, Theforeman Foreman.

How do I fix CVE-2026-12544?

Apply the vendor's patch.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-12544 being exploited?

There is no known exploitation of CVE-2026-12544 in the wild and no public exploit code.

All Redhat Satellite vulnerabilities

Sources

Also known as GHSA-q8r6-95rf-344m.