Red Hat Satellite (Foreman): Code execution via Safemode sandbox bypass
Summary
Red Hat Satellite, which is based on the Foreman project, contains a flaw in its template rendering engine. An authenticated attacker with low-level read permissions can manipulate the permitted methods list to bypass the Safemode sandbox and execute arbitrary commands on the Satellite server. Successful exploitation would give the attacker control over a server that holds credentials and manages provisioning and patching of managed hosts.
Affected
- Red Hat Satellite 6.16 (RHEL 8 and RHEL 9)
- Red Hat Satellite 6.17 (RHEL 9)
- Red Hat Satellite 6.18 (RHEL 9)
- Red Hat Satellite 6.19 (RHEL 9)
- Upstream Foreman releases with Safemode before 2.0.1 (for example 3.19.0, 3.19.1, 5.0.0)
- Exact vulnerable package ranges for Satellite: Unknown.
Fixed in
- Satellite 6.19.5 Async Update (RHSA-2026:74503)
- Satellite 6.18.10 Async Update (RHSA-2026:74504)
- Satellite 6.17.12 (RHSA-2026:74505)
- Satellite 6.16 (RHSA-2026:74506)
- Upstream Foreman 3.19.2 and 5.0.1; verify Safemode 2.0.1 or later is installed.
Workaround
Unknown. Red Hat states that no mitigation is available that meets its criteria.
Exploitation
- No evidence of active exploitation in the wild found; not listed in CISA KEV according to the sources checked.
- No public proof of concept confirmed for this CVE.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Patch Satellite or Foreman to the fixed versions listed above as a priority.
- Check installed satellite and Safemode package versions against the errata.
- Review and reduce accounts with read or view permissions, and rotate integration tokens.
- Keep the Satellite web UI and API on an internal management network, not the public internet.
- Review the related CVE-2026-96659 (Viewer role permissions) in the same errata.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Errata RHSA-2026:74503 access.redhat.com
- Red Hat Errata RHSA-2026:74504 access.redhat.com
- Red Hat Errata RHSA-2026:74505 access.redhat.com
- Red Hat Errata RHSA-2026:74506 access.redhat.com
- Red Hat CVE page CVE-2026-96658 access.redhat.com
- Red Hat Bugzilla 2534185 bugzilla.redhat.com
- Foreman security advisories theforeman.org
- Foreman 3.19.2 release announcement community.theforeman.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:56.
Original description (NVD)
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
NVD references (7)
- https://access.redhat.com/errata/RHSA-2026:74503
- https://access.redhat.com/errata/RHSA-2026:74504
- https://access.redhat.com/errata/RHSA-2026:74505
- https://access.redhat.com/errata/RHSA-2026:74506
- https://access.redhat.com/security/cve/CVE-2026-96658
- https://bugzilla.redhat.com/show_bug.cgi?id=2534185
- http://www.openwall.com/lists/oss-security/2026/10/07/2
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.