CVE-2026-12542

Summary

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Satellite 6.16 for RHEL 80:3.12.0.23-1.el8sat < *unaffected
Red HatRed Hat Satellite 6.16 for RHEL 90:3.12.0.23-1.el9sat < *unaffected
Red HatRed Hat Satellite 6.18 for RHEL 90:3.16.0.25-1.el9sat < *unaffected
Red HatRed Hat Satellite 6.19 for RHEL 90:3.18.0.14-1.el9sat < *unaffected

Weaknesses

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Workarounds

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

References