CVE-2026-96658
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A flaw in Foreman allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the server. By manipulating the permitted methods list in the template rendering engine, an attacker can bypass the safemode sandbox and execute unauthorized commands.
Risk Assessment
This enables remote code execution and full compromise of the Foreman server. It can lead to data theft, backdoor installation, and further network escalation.
Recommendation
Update Foreman to the latest version that fixes this vulnerability. Restrict user permissions to the minimum necessary.
Other vulnerabilities in Foreman
See all- CVE-2015-5246High
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
- CVE-2016-4996High
In Foreman before 6.2, when the SSH service is enabled on discovered nodes, discovery-debug displays the root password in plaintext in the system journal during login.
- CVE-2015-5152High
Foreman versions from 1.1 to before 1.9.0-RC1 do not redirect HTTP requests to HTTPS when the require_ssl setting is enabled. This allows remote attackers to obtain user credentials via a man-in-the-middle attack.
- CVE-2017-7505High
Foreman since version 1.5 is vulnerable to an incorrect authorization check, allowing users with user management permissions assigned to certain organizations to perform all operations granted by these permissions on administrator user objects outside their scope.
- CVE-2016-4475High
The Organization and Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions, enabling (a) reading, (b) editing, or (c) deleting arbitrary organizations or locations.
- CVE-2013-0210High
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
- CVE-2013-0171High
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
- CVE-2012-5648High
Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in search.rb or puppetclass.rb, related to the search mechanism.
- CVE-2026-96659Critical
A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.
- CVE-2026-107203Medium
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission, but does not apply the search limit on that permission. A low-privileged attacker can read interfaces of hosts they are not allowed to view, and if they have edit permissions, they can modify those interfaces.
Original NVD description (English source)
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS