Foreman Vulnerable Multi-Stage Execution Enables SSTI & RCE
CVE-2026-12544 Published on October 1, 2026
Foreman: ssti and insecure deserialization in foreman-rake configuration
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
Vulnerability Analysis
CVE-2026-12544 is exploitable with local system access, requires user interaction and user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 106 days later.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2026-12544 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2026-12544
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
Red Hat Satellite 6.16 for RHEL 8:- Version 0:3.12.0.23-1.el8sat and below * is unaffected.
- Version 0:3.12.0.23-1.el9sat and below * is unaffected.
- Version 0:3.14.0.22-1.el9sat and below * is unaffected.
- Version 0:3.16.0.25-1.el9sat and below * is unaffected.
- Version 0:3.18.0.14-1.el9sat and below * is unaffected.