Advisory · CVE-2026-12541
Foreman's backup commands took shell orders from file paths
OS command injection flaws in Foreman's database dump and import rake tasks let users with foreman-rake sudo rights append malicious shell commands to file path parameters.
- Vendor
- Red Hat
- Product
- Foreman
- Identifier / CWE
- CVE-2026-12541
CWE-78 - Action timing
- Immediate
Explain it like I’m five
The backup tool asked where to put the copy, then read the answer out loud to the computer word for word. Slip an extra instruction into the address and the computer followed it.
- 01Database task invoked
A user with permission to execute foreman-rake, for example via a restricted sudo configuration, runs the db:dump or db:import_dump task.
- 02Path parameter supplied
The user supplies the destination parameter during backups or the file parameter during imports.
- 03Sanitization skipped
The application passes the value to a Ruby system() call without properly sanitizing it.
- 04Commands appended
Malicious shell commands appended to the file path execute, granting control over the Satellite database and configurations and enabling lateral movement to full root code execution on managed hosts.
What happened
Red Hat published a fix for CVE-2026-12541, rated high at CVSS 8.2, as part of the Satellite 6.19.5 async update. OS command injection vulnerabilities (CWE-78) existed in the foreman-rake db:dump and db:import_dump tasks: the destination parameter during backups and the file parameter during imports were passed to a Ruby system() call without proper sanitization.
An attacker with permission to execute foreman-rake, for example through a restricted sudo configuration, could append malicious shell commands to the provided file paths. Red Hat’s assessment: successful exploitation escalates to the Foreman account and arbitrary command execution, granting control over the Satellite database and configurations and enabling lateral movement and full root remote code execution on all managed hosts.
What to do
- Update to Red Hat Satellite 6.19.5 following the RHSA-2026:74503 guidance.
- Review sudo configurations for foreman-rake access and restrict them to the minimum necessary.
- Audit backup and import logs for file path parameters containing shell metacharacters or unexpected commands.
- Red Hat reports no practical mitigation exists beyond updating, so prioritize the patch.
Management note
Backup tooling runs with the crown jewels in reach by design, which is exactly why it must never double as a command line. Same lesson as its sibling flaw in the log viewer: patch now, then tighten who gets to touch the rake tasks.