CVE-2026-96658
HIGHCVSS 8.8Description
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
Timeline
Published:October 1st, 2026 5:17 PM
Last modified:October 18th, 2026 7:16 AM
CVSS Scoring
CVSS v3: 8.8 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
From NVD CPE configuration data
Vendors
redhattheforeman
Products
satelliteforeman
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://access.redhat.com/errata/RHSA-2026:74503Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:74504Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:74505Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:74506Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-96658Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2534185Issue Tracking
- http://www.openwall.com/lists/oss-security/2026/10/07/2Mailing List
Source: NIST NVD · Data may lag official sources by up to one minute