IT SBIT Services
Schneeberger
DEEN
CVE tracker

Red Hat Satellite: Command injection in foreman-rake errors:fetch_log

CVE-2026-12540High 8.2

← All vulnerabilities

Summary

Red Hat Satellite, which is built on the upstream Foreman project, contains a command injection flaw in the foreman-rake errors:fetch_log task. The request_id parameter reaches a shell command without adequate neutralization. A local user with sudo permission to run this rake task can inject shell metacharacters and execute arbitrary code, potentially escalating to root on managed hosts (CVSS 3.1: 8.2).

Affected

  • Red Hat Satellite 6.16 for RHEL 8 and RHEL 9 (before the fixed builds in RHSA-2026:74506)
  • Red Hat Satellite 6.17 for RHEL 9 (before the fixed builds in RHSA-2026:74505)
  • Red Hat Satellite 6.18 for RHEL 9 (before the fixed builds in RHSA-2026:74504)
  • Red Hat Satellite 6.19 for RHEL 9 (before the fixed builds in RHSA-2026:74503)
  • Upstream Foreman 2.2.0 to 3.19.1 and 5.0.0 (according to the vendor advisory)

Fixed in

  • Red Hat Satellite: async updates RHSA-2026:74503 (6.19.5), RHSA-2026:74504 (6.18.10), RHSA-2026:74505 (6.17.12) and RHSA-2026:74506 (6.16.14). Exact package builds are listed in the advisories.
  • Upstream Foreman: 3.19.2 and 5.0.1
  • Whether older upstream branches received backports is unknown.

Workaround

Red Hat has investigated possible mitigations and has not identified a practical one. Patching is the recommended fix.

  • Until patching is complete, review sudoers entries that grant access to foreman-rake and remove any that are not essential. This is a recommendation of the author, not a vendor statement.

Exploitation

  • Attack requires local access and sudo permission to run the rake task (PR:H, AV:L).
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • No public proof of concept found. Not listed as known exploited (KEV) at the time of writing.

Our recommendation

  • Apply the Satellite async update for your version (RHSA-2026:74503 to RHSA-2026:74506) or Foreman 3.19.2 / 5.0.1 in your normal maintenance window.
  • Check which users and accounts hold sudo rights for foreman-rake and reduce them to the necessary minimum now.
  • Treat shared admin, helpdesk and automation accounts with broad sudo rights as the main risk.
  • Check whether your organisation actually runs Satellite or upstream Foreman.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:36.

Original description (NVD)

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed