Advisory · CVE-2026-12540
Foreman's log viewer doubled as a command line for privileged users
A command injection flaw in Foreman's errors:fetch_log rake task let users with sudo rights to the task inject shell metacharacters and run arbitrary code.
- Vendor
- Red Hat
- Product
- Foreman
- Identifier / CWE
- CVE-2026-12540
CWE-78 - Action timing
- Immediate
Explain it like I’m five
The log-reading tool was supposed to just look up entries, but it repeated whatever you told it straight to the computer's ear. Sneak in a second sentence and the computer obeyed that instead.
- 01Rake task invoked
A user with sudo permission to run the foreman-rake errors:fetch_log task invokes it with a request_id parameter.
- 02Input unsanitized
The request_id value is passed to an underlying system command, typically grep, without adequate shell neutralization.
- 03Metacharacters injected
The user appends shell metacharacters such as semicolons, quotes, or pipes to break out of the intended command.
- 04Code executed
Arbitrary commands run as the Foreman service account, which Red Hat notes can escalate to root across all managed hosts, organizations, and locations.
What happened
Red Hat published a fix for CVE-2026-12540, rated high at CVSS 8.2, as part of the Satellite 6.19.5 async update. A command injection vulnerability (CWE-78) existed in the foreman-rake errors:fetch_log task: the request_id parameter was passed to an underlying system command, typically grep, without adequate shell neutralization.
An attacker with sudo permission to execute this rake task could inject shell metacharacters such as semicolons, quotes, or pipes to break out of the intended command and execute arbitrary code. Red Hat’s assessment is blunt: successful exploitation lets a restricted user escalate to the Foreman user and subsequently to root across all managed hosts, a complete compromise of the Satellite server and everything it manages.
What to do
- Update to Red Hat Satellite 6.19.5 following the RHSA-2026:74503 guidance.
- Review sudo configurations for foreman-rake access and restrict them to the minimum necessary.
- Audit logs for unusual foreman-rake invocations, especially request_id values containing shell metacharacters.
- Red Hat reports no practical mitigation exists beyond updating, so prioritize the patch.
Management note
Satellite is the control plane for your infrastructure, so a command injection in its own tooling is a skeleton key to the data center. The patch is the fix; the sudoers review is the lesson.