CVE-2026-12542 — Foreman: command injection in foreman-tail

Description (CNA)

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Satellite 6.16 for RHEL 8	unaffected 0:3.12.0.23-1.el8sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 9	unaffected 0:3.12.0.23-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9	unaffected 0:3.14.0.22-1.el9sat before *
Red Hat / Red Hat Satellite 6.18 for RHEL 9	unaffected 0:3.16.0.25-1.el9sat before *
Red Hat / Red Hat Satellite 6.19 for RHEL 9	unaffected 0:3.18.0.14-1.el9sat before *
Red Hat / Red Hat Satellite 6	affected

CWE

CWE-78

References

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/07/7