Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Red Hat Satellite backup commands can run attacker code

CVE-2026-12541 · published 1 month ago
Summary

The backup and import features in Red Hat Satellite allow users to specify file paths, but the software does not properly clean those inputs. An attacker who can run the foreman-rake command could add extra commands to the file name and have them executed on the server. Limit who can run foreman-rake and apply patches or updates that fix the input handling.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
red hat red hat satellite 6.19 for rhel 9 All versions
red hat red hat satellite 6 All versions
red hat red hat satellite 6.16 for rhel 8 All versions
red hat red hat satellite 6.16 for rhel 9 All versions
red hat red hat satellite 6.18 for rhel 9 All versions
red hat red hat satellite 6.17 for rhel 9 All versions
Original advisory text
Foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published1 Oct 2026
Updated31 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-12541 · NVD
CVE-2026-12541 · MITRE
Track software like this
Free during beta