{"id":"CVE-2026-12542","state":"PUBLISHED","title":"Foreman: command injection in foreman-tail","description":"A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.","publishedAt":"2026-10-01T17:14:49.985Z","updatedAt":"2026-10-07T06:12:06.548Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Satellite 6.16 for RHEL 8","Red Hat Red Hat Satellite 6.16 for RHEL 9","Red Hat Red Hat Satellite 6.17 for RHEL 9","Red Hat Red Hat Satellite 6.18 for RHEL 9","Red Hat Red Hat Satellite 6.19 for RHEL 9","Red Hat Red Hat Satellite 6"],"affected":[{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.23-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.23-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.14.0.22-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.16.0.25-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.18.0.14-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite:el8/foreman","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"]}],"references":["https://access.redhat.com/errata/RHSA-2026:74503","https://access.redhat.com/errata/RHSA-2026:74504","https://access.redhat.com/errata/RHSA-2026:74505","https://access.redhat.com/errata/RHSA-2026:74506","https://access.redhat.com/security/cve/CVE-2026-12542","https://bugzilla.redhat.com/show_bug.cgi?id=2489971","http://www.openwall.com/lists/oss-security/2026/10/07/7"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12542.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12542","state":"PUBLISHED","datePublished":"2026-10-01T17:14:49.985Z","dateUpdated":"2026-10-07T06:12:06.548Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-06-17T17:41:37.643Z"},"containers":{"cna":{"title":"Foreman: command injection in foreman-tail","descriptions":[{"lang":"en","value":"A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.23-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.12.0.23-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.14.0.22-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.16.0.25-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.18.0.14-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite:el8/foreman","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74503","name":"RHSA-2026:74503","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","name":"RHSA-2026:74504","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","name":"RHSA-2026:74505","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","name":"RHSA-2026:74506","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12542","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971","name":"RHBZ#2489971","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-02T17:37:02.943Z"},"datePublic":"2026-10-01T12:20:00.000Z","x_redhatCweChain":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","workarounds":[{"lang":"en","value":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}],"timeline":[{"lang":"en","time":"2026-06-17T16:46:27.440Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-01T12:20:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Laura Pardo (Red Hat) and Toni Gornals (Red Hat)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/7"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-07T06:12:06.548Z"}}]}}}