CVE-2026-12540— Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
Quick assessment
Affected
Red Hat Red Hat Satellite 6.16 for RHEL 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Foreman 中发现了一个漏洞。foreman-rake 的 任务中存在命令注入漏洞。该任务的 参数在传递给底层系统命令（通常为 grep）时，未进行充分的 shell 转义处理。尽管该任务旨在获取特定的日志条目，但拥有执行此 rake 任务的 sudo 权限的攻击者可以注入 shell 元字符（如 、 或 ），从而突破预期命令的执行范围，进而执行任意代码。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12540
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.12.0.23-1.el8sat ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.12.0.23-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.16.0.25-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.18::el9
|
|
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.18.0.14-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.19::el9
|
|
| Red Hat | Red Hat Satellite 6 | - |
cpe:/a:redhat:satellite:6
|
|
II. Public POCs for CVE-2026-12540
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12540
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12540 (5)
-
-
-
🔗 RHSA-2026:74504 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
Same Patch Batch · Red Hat · 2026-10-01 · 18 CVEs total
| CVE-2026-96658 | 9.9 CRITICAL | Foreman: safemode bypass leading to rce |
| CVE-2026-96659 | 9.1 CRITICAL | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-86345 | 9.0 CRITICAL | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to f |
| CVE-2026-12405 | 8.8 HIGH | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user |
| CVE-2026-12541 | 8.2 HIGH | Foreman: command injection in foreman-rake database tasks |
| CVE-2026-12544 | 7.7 HIGH | Foreman: ssti and insecure deserialization in foreman-rake configuration |
| CVE-2026-86344 | 7.5 HIGH | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-oper |
| CVE-2026-12423 | 7.5 HIGH | Foreman: unauthenticated information disclosure via provisioning token validation flaw |
| CVE-2026-96577 | 7.1 HIGH | Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without a |
| CVE-2026-12545 | 6.7 MEDIUM | Rubygem-hammer_cli: command injection via insecure editor invocation |
| CVE-2026-56097 | 6.5 MEDIUM | Rubygem-katello: sql injection in registry proxy via labels |
| CVE-2026-103884 | 6.5 MEDIUM | Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allow |
| CVE-2026-83589 | 6.1 MEDIUM | Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect |
| CVE-2026-103754 | 5.9 MEDIUM | Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows |
| CVE-2026-103641 | 5.5 MEDIUM | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder |
| CVE-2026-12542 | 5.3 MEDIUM | Foreman: command injection in foreman-tail |
| CVE-2026-56098 | 4.3 MEDIUM | Rubygem-katello: improper authorization logic allows resource enumeration |
IV. Related Vulnerabilities
Same product: Red Hat Satellite 6.16 for RHEL 8
-
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-56097
Rubygem-katello: sql injection in registry proxy via labels -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in -
CVE-2026-12542
Foreman: command injection in foreman-tail -
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
Same vendor: Red Hat
-
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in
Same weakness: CWE-78
-
CVE-2026-71452
Johnson Controls EasyIO FS32 3.0b63以下命令注入漏洞 -
CVE-2026-71451
Johnson Controls EasyIO FS32 < 3.0b63 命令注入漏洞 -
CVE-2026-84682
TDDPv2 setProductVer Command Injection in Archer AX90 -
CVE-2026-102294
Authenticated OS Command Injection in TL-WR841N IPv6 WAN Con -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in
V. Comments for CVE-2026-12540
No comments yet