CVE-2026-96658— Foreman: safemode bypass leading to rce
Quick assessment
Affected
Red Hat Red Hat Satellite 6.16 for RHEL 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Foreman 中发现了一个漏洞。拥有低权限的已认证攻击者可以通过绕过模板引擎中的安全模式（safemode）沙箱机制，实现远程代码执行（RCE）。由于对委托方法的处理不当，攻击者可以将未授权的功能添加到允许执行的列表中，从而在托管服务器上执行任意命令。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 15
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:1.5.0-2.el8sat< * |
unaffected |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:1.5.0-2.el9sat< * |
unaffected |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0.22-1.el9sat< * |
unaffected |
0:3.2.13-1.el9pc< * |
unaffected | ||
0:3.1.62-1.el9pc< * |
unaffected | ||
0:5.3.1-2.el9pc< * |
unaffected | ||
0:0.6.0-1.el9pc< * |
unaffected | ||
0:15.0.2-2.el9sat< * |
unaffected | ||
0:3.14.0-2.el9sat< * |
unaffected | ||
0:4.16.0.20-1.el9sat< * |
unaffected | ||
| … +3 more rows | |||
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:1.5.0-2.el9sat< * |
unaffected |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.18.0.14-1.el9sat< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96658
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Foreman: safemode bypass leading to rce
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:1.5.0-2.el8sat ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:1.5.0-2.el9sat ~ * |
cpe:/a:redhat:satellite:6.16::el8
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0.22-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.2.13-1.el9pc ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.1.62-1.el9pc ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:5.3.1-2.el9pc ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.6.0-1.el9pc ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:15.0.2-2.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.14.0-2.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:4.16.0.20-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:1.5.0-2.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:6.17.12-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:0.1.0-2.1.el9sat ~ * |
cpe:/a:redhat:satellite:6.17::el9
|
|
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:1.5.0-2.el9sat ~ * |
cpe:/a:redhat:satellite:6.18::el9
|
|
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:3.18.0.14-1.el9sat ~ * |
cpe:/a:redhat:satellite:6.19::el9
|
|
II. Public POCs for CVE-2026-96658
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96658
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-96658 (6)
-
-
🔗 2534185 – (CVE-2026-96658) CVE-2026-96658 foreman: Safemode Bypass leading to RCE Read full article issue-tracking x_refsource_REDHAT
-
🔗 RHSA-2026:74504 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
🔗 RHSA-2026:74505 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-01 · 18 CVEs total
| CVE-2026-96659 | 9.1 CRITICAL | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-86345 | 9.0 CRITICAL | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to f |
| CVE-2026-12405 | 8.8 HIGH | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user |
| CVE-2026-12540 | 8.2 HIGH | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter |
| CVE-2026-12541 | 8.2 HIGH | Foreman: command injection in foreman-rake database tasks |
| CVE-2026-12544 | 7.7 HIGH | Foreman: ssti and insecure deserialization in foreman-rake configuration |
| CVE-2026-86344 | 7.5 HIGH | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-oper |
| CVE-2026-12423 | 7.5 HIGH | Foreman: unauthenticated information disclosure via provisioning token validation flaw |
| CVE-2026-96577 | 7.1 HIGH | Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without a |
| CVE-2026-12545 | 6.7 MEDIUM | Rubygem-hammer_cli: command injection via insecure editor invocation |
| CVE-2026-56097 | 6.5 MEDIUM | Rubygem-katello: sql injection in registry proxy via labels |
| CVE-2026-103884 | 6.5 MEDIUM | Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allow |
| CVE-2026-83589 | 6.1 MEDIUM | Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect |
| CVE-2026-103754 | 5.9 MEDIUM | Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows |
| CVE-2026-103641 | 5.5 MEDIUM | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder |
| CVE-2026-12542 | 5.3 MEDIUM | Foreman: command injection in foreman-tail |
| CVE-2026-56098 | 4.3 MEDIUM | Rubygem-katello: improper authorization logic allows resource enumeration |
IV. Related Vulnerabilities
Same product: Red Hat Satellite 6.16 for RHEL 8
-
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-56097
Rubygem-katello: sql injection in registry proxy via labels -
CVE-2026-12542
Foreman: command injection in foreman-tail -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in -
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50
V. Comments for CVE-2026-96658
No comments yet