High
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
Type: advisorySources: OSV
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-96658
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 01:23 UTC · Revision 1
Source evidence
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
core-osv · Original sourcePublished 1 Oct 2026, 16:23 UTC
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
osv:CVE-2026-96658
Complete source record
{
"id": "e7671da18aa7ba46ea17d0da2e7b8ca53e322debd7009db60dded932fdb3ebb1",
"url": "https://osv.dev/vulnerability/CVE-2026-96658",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Foreman: foreman: arbitrary code execution via safemode sandbox bypass",
"summary": "A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.",
"evidence": "osv:CVE-2026-96658",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-96658",
"aliases": [
"CVE-2026-96658"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/theforeman/foreman",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a7d8400d08c6710a784b4703c662e56bf5a47671"
},
{
"introduced": "d82d6878ac1683790d4ea1e54772e2f047d4254a"
},
{
"last_affected": "092a456bdea31af4e91d7088856bd67aaff64c25"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.0"
},
{
"last_affected": "3.19.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.1"
},
{
"last_affected": "3.19.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.19.0",
"3.19.1",
"5.0.0",
"5.0.0-rc2",
"5.0.0-rc1",
"2.0.0",
"2.0.0-rc3",
"2.0.0-rc2",
"2.0.0-rc1",
"1.1",
"1.1RC5",
"1.1RC4",
"1.1RC3",
"1.1RC2",
"1.1RC1",
"1.0",
"1.0RC5",
"1.0RC4",
"1.0RC3",
"1.0RC2",
"1.0RC1",
"0.4",
"0.4rc5",
"0.4rc4",
"0.4rc3",
"0.4rc2",
"0.3",
"0.2",
"0.2rc1",
"0.1-6",
"0.1-5",
"0.1-4",
"0.1-3",
"0.1-2",
"0.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/theforeman/foreman-installer",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "dcc764bed9867eae7b78f1c7b395199583bba5e9"
},
{
"introduced": "c08fe88ada05e9b7fb6f1c4a24d2939f47c7e5c7"
},
{
"last_affected": "e081fe7c568a5e597c0b9b6cfb025abf36edc2ff"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.0"
},
{
"last_affected": "3.19.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.1"
},
{
"last_affected": "3.19.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.19.0",
"3.19.1",
"5.0.0",
"5.0.0-rc2",
"5.0.0-rc1",
"2.0.0",
"2.0.0-rc3",
"2.0.0-rc2",
"2.0.0-rc1",
"1.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/theforeman/smart-proxy",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "67dde61f6894010ed862c1c99060bdcfba727269"
},
{
"introduced": "8b7a6d6c5955634c2bff9d8789234b0d7c3fe616"
},
{
"last_affected": "e63094f9ee6794882fabc2889877372459bf7072"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.0"
},
{
"last_affected": "3.19.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.1"
},
{
"last_affected": "3.19.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.19.0",
"3.19.1",
"5.0.0",
"5.0.0-rc2",
"5.0.0-rc1",
"2.0.0",
"2.0.0-rc3",
"2.0.0-rc2",
"2.0.0-rc1",
"1.1",
"1.1RC3",
"1.1RC2",
"1.1RC1",
"1.0",
"1.0RC2",
"1.0RC1",
"0.3",
"0.2",
"0.2rc2",
"0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"
}
}
],
"modified": "2026-10-28T02:30:45.596631333Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://access.redhat.com/errata/RHSA-2026:74503",
"https://access.redhat.com/errata/RHSA-2026:74504",
"https://access.redhat.com/errata/RHSA-2026:74505",
"https://access.redhat.com/errata/RHSA-2026:74506",
"https://access.redhat.com/security/cve/CVE-2026-96658",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96658.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-96658",
"https://bugzilla.redhat.com/show_bug.cgi?id=2534185"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:1.5.0-2.el8sat"
},
{
"fixed": "0:1.5.0-2.el9sat"
},
{
"fixed": "0:3.14.0.22-1.el9sat"
},
{
"fixed": "0:3.2.13-1.el9pc"
},
{
"fixed": "0:3.1.62-1.el9pc"
},
{
"fixed": "0:5.3.1-2.el9pc"
},
{
"fixed": "0:0.6.0-1.el9pc"
},
{
"fixed": "0:15.0.2-2.el9sat"
},
{
"fixed": "0:3.14.0-2.el9sat"
},
{
"fixed": "0:4.16.0.20-1.el9sat"
},
{
"fixed": "0:1.5.0-2.el9sat"
},
{
"fixed": "0:6.17.12-1.el9sat"
},
{
"fixed": "0:0.1.0-2.1.el9sat"
},
{
"fixed": "0:1.5.0-2.el9sat"
},
{
"fixed": "0:3.18.0.14-1.el9sat"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96658.json"
}
},
"related_cves": [
{
"value": "CVE-2026-96658",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 513818,
"published_at": "2026-10-01T16:23:23.688+00:00"
}