Foreman RCE: SafeMode Templating Bypass
CVE-2026-96658 Published on October 1, 2026

Foreman: foreman: arbitrary code execution via safemode sandbox bypass
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-96658 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 16 days later.

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2026-96658 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2026-96658

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Satellite
Red Hat Satellite Capsule
Red Hat Satellite Utils

Affected Versions

Red Hat Satellite 6.16 for RHEL 8: Red Hat Satellite 6.16 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.17 for RHEL 9: Red Hat Satellite 6.18 for RHEL 9: Red Hat Satellite 6.19 for RHEL 9: