Red Hat Satellite (Foreman): OS command injection in database rake tasks
Summary
Foreman, the basis of Red Hat Satellite, contains OS command injection flaws in the foreman-rake db:dump and db:import_dump tasks. User-supplied values in the destination and file parameters are passed unsanitized to a Ruby system() call. An attacker who may run foreman-rake, for example through a restricted sudo rule, can append shell commands and have them executed with high impact on the host and its database. Exploitation requires local access and high privileges.
Affected
- Red Hat Satellite 6.16 for RHEL 8 and RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
- Upstream Foreman 1.5.0 through 3.19.1 and 5.0.0
- Satellite 6.15 and earlier: unknown
Fixed in
- Foreman 3.19.2 and 5.0.1 (upstream)
- Satellite 6.19: RHSA-2026:74503 (6.19.5 async update)
- Satellite 6.18: RHSA-2026:74504 (6.18.10 async update)
- Satellite 6.16: RHSA-2026:74506 (6.16.14 async update)
- Satellite 6.17: unknown, check the RHSA package list
Workaround
Unknown. Red Hat has not identified a practical mitigation and recommends updating.
- Interim measure (not vendor guidance): review and narrow sudo rules that allow foreman-rake, and limit who can run database backup and import tasks.
Exploitation
- Not known to be exploited in the wild (CISA KEV: no).
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
Our recommendation
- Identify all Foreman and Satellite instances, including Capsules, and their versions.
- Patch to the fixed Foreman version or the matching Red Hat erratum, and verify the mapping against the RHSA package list.
- Audit sudo rules and accounts that can run foreman-rake, and remove unneeded access.
- Monitor KEV and vendor updates for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Security Advisory RHSA-2026:74503 (Satellite 6.19) access.redhat.com
- Red Hat Security Advisory RHSA-2026:74504 (Satellite 6.18) access.redhat.com
- Red Hat Security Advisory RHSA-2026:74506 (Satellite 6.16) access.redhat.com
- Red Hat CVE record CVE-2026-12541 access.redhat.com
- Red Hat Bugzilla 2489970 bugzilla.redhat.com
- Foreman security advisories theforeman.org
- Foreman 5.0.1 release announcement community.theforeman.org
- oss-security announcement www.openwall.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:37.
Original description (NVD)
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
NVD references (7)
- https://access.redhat.com/errata/RHSA-2026:74503
- https://access.redhat.com/errata/RHSA-2026:74504
- https://access.redhat.com/errata/RHSA-2026:74505
- https://access.redhat.com/errata/RHSA-2026:74506
- https://access.redhat.com/security/cve/CVE-2026-12541
- https://bugzilla.redhat.com/show_bug.cgi?id=2489970
- http://www.openwall.com/lists/oss-security/2026/10/07/8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.