Summary
Ein Angreifer kann mehrere Schwachstellen in Foreman ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
Product
Foreman ist ein Open-Source-Tool zur Automatisierung des Lebenszyklus von Servern, einschliesslich Provisionierung, Konfigurationsmanagement und Überwachung.
Vulnerabilities 7
-
Critical 9.1
Foreman: excessive permissions for viewer role on preview
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sen…
-
High 8.8
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engi…
-
High 8.2
Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is inten…
-
High 8.2
Foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (…
-
High 7.7
Foreman: ssti and insecure deserialization in foreman-rake configuration
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution c…
-
High 7.5
Foreman: unauthenticated information disclosure via provisioning token validation flaw
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than i…
-
Medium 5.3
Foreman: command injection in foreman-tail
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expan…
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-6M3J-QCJR-3VQM
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-C5Q9-9FC7-JGXP
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-RCQ3-9WPF-P347
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-Q8R6-95RF-344M
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-2FJ2-WWPQ-F5JR
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-G2WG-RX2F-4J5R
-
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-79JG-9WX4-F5RR
-
Red Hat Security Advisory RHSA-2026:74505 vom 2026-10-02
https://access.redhat.com/errata/RHSA-2026:74505
-
Red Hat Security Advisory RHSA-2026:99950 vom 2026-11-13
https://access.redhat.com/errata/RHSA-2026:99950
-
Red Hat Security Advisory RHSA-2026:99949 vom 2026-11-13
https://access.redhat.com/errata/RHSA-2026:99949
-
Red Hat Security Advisory RHSA-2026:99952 vom 2026-11-13
https://access.redhat.com/errata/RHSA-2026:99952