CVE-2026-12540
A command injection vulnerability exists in the foreman-rake errors:fetch_log task.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 1.24% probability · 69th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- redhat/satellite · theforeman/foreman
- Source
- secalert@redhat.com
EPSS moved from 1.3% on 2 October 2026 to 1.2% on 26 October 2026.
References
- https://access.redhat.com/errata/RHSA-2026:74503Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:74504Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:74505Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:74506Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-12540Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2489969Issue Tracking, Mitigation, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/07/9Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.