Red Hat Satellite: Template injection and insecure deserialization in Foreman
Summary
Red Hat Satellite 6 includes Foreman, whose foreman-rake configuration logic processes configuration data through two execution layers. This enables Server-Side Template Injection (SSTI) and insecure deserialization. An attacker with high privileges and user interaction can achieve remote code execution, which may lead to a full compromise of the managed infrastructure.
Affected
- Red Hat Satellite 6.16 for RHEL 8 and RHEL 9 (before foreman 3.12.0.23-1)
- Red Hat Satellite 6.17 for RHEL 9 (before the fixed build in RHSA-2026:74505; version not stated)
- Red Hat Satellite 6.18 for RHEL 9 (before foreman 3.16.0.25-1)
- Red Hat Satellite 6.19 for RHEL 9 (before foreman 3.18.0.14-1)
- Upstream Foreman 1.0 through 3.19.1 and 5.0.0 (ERB execution path from 1.15.0)
Fixed in
- Satellite 6.16: RHSA-2026:74506 (foreman 3.12.0.23-1.el8sat and el9sat)
- Satellite 6.17: RHSA-2026:74505
- Satellite 6.18: RHSA-2026:74504 (foreman 3.16.0.25-1.el9sat)
- Satellite 6.19: RHSA-2026:74503 (foreman 3.18.0.14-1.el9sat)
- Upstream Foreman: 3.19.2 and 5.0.1
Workaround
Red Hat investigated possible mitigations and found no practical one. Update the affected package as soon as possible.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
Our recommendation
- Apply the Satellite errata for your version (RHSA-2026:74503, 74504, 74505 or 74506) in the normal update cycle; the errata also fix other critical flaws.
- Restrict who can change Foreman configuration and who has shell or sudo access to foreman-rake.
- Check whether Satellite or Foreman is in use; if not, no action is needed for this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RHSA-2026:74503 access.redhat.com
- RHSA-2026:74504 access.redhat.com
- RHSA-2026:74505 access.redhat.com
- RHSA-2026:74506 access.redhat.com
- Red Hat CVE record CVE-2026-12544 access.redhat.com
- Red Hat Bugzilla 2489992 bugzilla.redhat.com
- Upstream Foreman security advisory theforeman.org
- OpenCVE CVE-2026-12544 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 09:23.
Original description (NVD)
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
NVD references (7)
- https://access.redhat.com/errata/RHSA-2026:74503
- https://access.redhat.com/errata/RHSA-2026:74504
- https://access.redhat.com/errata/RHSA-2026:74505
- https://access.redhat.com/errata/RHSA-2026:74506
- https://access.redhat.com/security/cve/CVE-2026-12544
- https://bugzilla.redhat.com/show_bug.cgi?id=2489992
- http://www.openwall.com/lists/oss-security/2026/10/07/6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.