IT SBIT Services
Schneeberger
DEEN
CVE tracker

Red Hat Satellite: Command injection in foreman-tail

CVE-2026-12542High 7.8

← All vulnerabilities

Summary

Red Hat Satellite (based on Foreman) contains an OS command injection flaw in the foreman-tail utility. The utility passes user-supplied arguments unsanitized and unquoted to eval when expanding file paths. A local attacker with a low-privilege account can inject shell metacharacters to run arbitrary system commands on the Satellite or Foreman server, which manages many hosts. The CVSS score differs between sources: the CVE data lists 7.8, while the Foreman project and OpenCVE list 5.3.

Affected

  • Red Hat Satellite 6.16 (RHEL 8 and RHEL 9), 6.17, 6.18 and 6.19 as listed in the CVE record (affected by default)
  • Upstream Foreman 1.5.0 to 3.19.1 and 5.0.0 (per the Foreman security page)
  • Orcharhino: affected versions not confirmed in the sources

Fixed in

  • Upstream Foreman 3.19.2 and 5.0.1
  • Red Hat: RHSA-2026:74503, RHSA-2026:74504, RHSA-2026:74505 and RHSA-2026:74506 (exact fixed package versions unknown; check the RHSA pages)
  • Orcharhino: fixes available in the repositories for versions 7.8, 7.9 and 7.10

Workaround

  • Red Hat found no practical mitigation and recommends updating the affected package as soon as possible.
  • Limit user permissions on the server to prevent arbitrary execution of the foreman-tail utility.

Exploitation

  • Not marked as known exploited by the sources checked. The KEV catalog was not checked directly.
  • No public proof-of-concept found in the searches performed; this does not rule one out.

Our recommendation

  • Check whether Satellite, Foreman or orcharhino is in use and which version.
  • Apply the vendor errata or upstream fix (Foreman 3.19.2 / 5.0.1) and confirm package versions in the RHSA pages.
  • Review local accounts on the server and remove unneeded shell access.
  • Verify the CVSS score in NVD before finalising the risk rating.
  • Do not expose Satellite or Foreman admin consoles to the internet.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:36.

Original description (NVD)

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed