Skip to content
Heist/ feed
High

Foreman: ssti and insecure deserialization in foreman-rake configuration

Type: advisorySource: Official CVE List1 source record

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Announced Source revision 1
Original source ↗

CVE-2026-12544

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-12544

Red Hat Satellite 6.16 for RHEL 8

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Satellite 6.16 for RHEL 9

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Satellite 6.17 for RHEL 9

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Satellite 6.18 for RHEL 9

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Satellite 6.19 for RHEL 9

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Satellite 6

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6.16::el8",
      "cpe:/a:redhat:satellite:6.16::el9",
      "cpe:/a:redhat:satellite_capsule:6.16::el8",
      "cpe:/a:redhat:satellite_capsule:6.16::el9",
      "cpe:/a:redhat:satellite_utils:6.16::el8",
      "cpe:/a:redhat:satellite_utils:6.16::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6.16 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.12.0.23-1.el8sat",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "foreman",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6.16::el8",
      "cpe:/a:redhat:satellite:6.16::el9",
      "cpe:/a:redhat:satellite_capsule:6.16::el8",
      "cpe:/a:redhat:satellite_capsule:6.16::el9",
      "cpe:/a:redhat:satellite_utils:6.16::el8",
      "cpe:/a:redhat:satellite_utils:6.16::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6.16 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.12.0.23-1.el9sat",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "foreman",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6.17::el9",
      "cpe:/a:redhat:satellite_capsule:6.17::el9",
      "cpe:/a:redhat:satellite_utils:6.17::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6.17 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.14.0.22-1.el9sat",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "foreman",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6.18::el9",
      "cpe:/a:redhat:satellite_capsule:6.18::el9",
      "cpe:/a:redhat:satellite_utils:6.18::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6.18 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.16.0.25-1.el9sat",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "foreman",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6.19::el9",
      "cpe:/a:redhat:satellite_capsule:6.19::el9",
      "cpe:/a:redhat:satellite_utils:6.19::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6.19 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.18.0.14-1.el9sat",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "foreman",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6",
    "packageName": "satellite:el8/foreman",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-12544

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#11756 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement