---
id: CVE-2026-12540
title: A flaw was found in Foreman
summary: >-
  A flaw was found in Foreman. A command injection vulnerability exists in the
  foreman-rake errors:fetch_log task. The request_id parameter is passed to an
  underlying system command (typically grep) without adequate shell
  neutralization. W…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: redhat
product: satellite
affected:
  - 'satellite >= 6.16, < 6.16.4'
  - 'satellite >= 6.17, < 6.17.12'
  - 'satellite >= 6.19, < 6.19.5'
  - foreman
  - 'satellite >= 6.18, < 6.18.10'
  - satellite = 6.0
patched:
  - satellite 6.18.10
published: '2026-10-01'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:16:09.560'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12540'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:74503'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74504'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74505'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74506'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12540'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2489969'
    label: secalert@redhat.com
  - url: 'http://www.openwall.com/lists/oss-security/2026/10/07/9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12540.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-12540'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12540'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.01236
epssPercentile: 0.68923
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T01:48:01.315252Z'
ingestedAt: '2026-10-01T18:55:42.359Z'
---

## Overview

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

## Affected

- `satellite >= 6.16, < 6.16.4`
- `satellite >= 6.17, < 6.17.12`
- `satellite >= 6.19, < 6.19.5`
- `foreman`
- `satellite >= 6.18, < 6.18.10`
- `satellite = 6.0`

## Remediation

Upgrade past the affected range:

- `satellite 6.18.10`

## Vendor advisories

- **RHSA-2026:74506** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74506)
- **RHSA-2026:74504** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74504)
- **RHSA-2026:74503** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74503)
- **Red Hat VEX** · Important · affected: Red Hat Satellite 6 · no fix planned: Red Hat Satellite 6 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12540.json)
- **RHSA-2026:74505** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74505)