CVE-2026-12544CWE-502insecure-deserialization

CVE-2026-12544

High · published October 1, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-10-01T21:17Z
Affected products (6)
ProductVersionsFixed in
redhat/satelliteall versions—
redhat/satellite≥ 6.16, < 6.16.46.16.4
redhat/satellite≥ 6.17, < 6.17.126.17.12
redhat/satellite≥ 6.19, < 6.19.56.19.5
theforeman/foremanall versions—
redhat/satellite≥ 6.18, < 6.18.106.18.10
References (7)
https://access.redhat.com/errata/RHSA-2026:74503 · [email protected]https://access.redhat.com/errata/RHSA-2026:74504 · [email protected]https://access.redhat.com/errata/RHSA-2026:74505 · [email protected]https://access.redhat.com/errata/RHSA-2026:74506 · [email protected]https://access.redhat.com/security/cve/CVE-2026-12544 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2489992 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/07/6 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 16:22Z
    Foreman: ssti and insecure deserialization in foreman-rake configuration
    cvelistv5