← CVE Intelligence

CVE-2026-96658

Foreman: foreman: arbitrary code execution via safemode sandbox bypass PUBLISHED

Description (CNA)

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Satellite 6.16 for RHEL 8unaffected 0:1.5.0-2.el8sat before *
Red Hat / Red Hat Satellite 6.16 for RHEL 9unaffected 0:1.5.0-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.14.0.22-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.2.13-1.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.1.62-1.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:5.3.1-2.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:0.6.0-1.el9pc before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:15.0.2-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:3.14.0-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:4.16.0.20-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:1.5.0-2.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:6.17.12-1.el9sat before *
Red Hat / Red Hat Satellite 6.17 for RHEL 9unaffected 0:0.1.0-2.1.el9sat before *
Red Hat / Red Hat Satellite 6.18 for RHEL 9unaffected 0:1.5.0-2.el9sat before *
Red Hat / Red Hat Satellite 6.19 for RHEL 9unaffected 0:3.18.0.14-1.el9sat before *

CWE

CWE-94

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.