Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1001
_____________________________________________________________________

DATE                : 09/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Katello versions prior to 5.1,
                 Foreman Remote Execution versions prior to 18.0.1,
                                  17.2.2, 16.6.6,
                       Foreman versions prior to 3.19.2, 5.0.1.

====================================================================
https://theforeman.org/security.html#2026-12544
_____________________________________________________________________

CVE-2026-79654: Katello: missing content view authorization in
history API exposes cross-organization existence

In Katello, a content view history API-endpoint where insufficient
authorization checks in the ContentViewHistoriesController allowed
users to query content information for content views outside the
organization the user was authorized for. An authenticated attacker
could exploit this issue to determine whether specific content exists
within content views that should otherwise be inaccessible. This
issue does not allow unauthorized modification, import, or publication
of content.

    Affects all Katello versions at or above version 2.4.0.
    Fix to be released in Katello 5.1.
    Redmine issue: #39701
    GitHub PR #11847


CVE-2026-12405: Foreman Remote Execution: command injection via
effective_user

An authenticated user with permission to execute job templates can inject
commands through the overridable effective_user parameter during job
invocation. Improper input handling allows command execution with the
execution user’s privileges on managed hosts.

    Affects Foreman Remote Execution 0.1.2–16.6.5, 16.7.0,
     17.0.0–17.2.1, and 18.0.0
    CVSS: 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H;
     vendor severity: Important
    CWE: CWE-78
    Fix released in Foreman Remote Execution 18.0.1, 17.2.2,
     and 16.6.6
    Redmine issue: #39836
    GitHub PR 1072

CVE-2026-12423: Foreman: provisioning token validation flaw

An unauthenticated request can reach build-host provisioning
through an IP/MAC fallback when no valid provisioning token is
supplied. The fallback is reachable in token-enabled Red Hat-family
provisioning configurations and can expose provisioning data.

    Affects Foreman 1.1 through 3.19.1, and 5.0.0
    CVSS: 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N;
     vendor severity: Important
    CWE: CWE-306
    Fix released in Foreman 3.19.2 and 5.0.1
    Redmine issue: #39837
    GitHub PR 11310


CVE-2026-12540: Foreman: command injection in foreman-rake
errors:fetch_log

A user allowed to run the restricted foreman-rake log task can
cause command execution through its request identifier parameter.
Unsafe shell handling can compromise the Foreman server.

    Affects Foreman 2.2.0 through 3.19.1, and 5.0.0
    CVSS: 8.2, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H;
     vendor severity: Important
    CWE: CWE-78
    Fix released in Foreman 3.19.2 and 5.0.1
    Redmine issue: #39838
    GitHub PR 11310


CVE-2026-12541: Foreman: command injection in foreman-rake
database tasks

A user allowed to run restricted foreman-rake database tasks can
cause command execution through file path parameters. Unsafe shell
handling can compromise the Foreman server and its database.

    Affects Foreman 1.5.0 through 3.19.1, and 5.0.0
    CVSS: 8.2, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H;
     vendor severity: Important
    CWE: CWE-78
    Fix released in Foreman 3.19.2 and 5.0.1
    Redmine issue: #39839
    GitHub PR 11310


CVE-2026-12542: Foreman: command injection in foreman-tail

A local user with access to foreman-tail can inject commands because
user input is evaluated unsafely. Successful exploitation allows
arbitrary command execution on the Foreman server.

    Affects Foreman 1.5.0 through 3.19.1, and 5.0.0
    CVSS: 5.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L;
     vendor severity: Moderate
    CWE: CWE-78
    Fix released in Foreman 3.19.2 and 5.0.1
    Redmine issue: #39840
    GitHub PR 11310


CVE-2026-12544: Foreman: SSTI and unsafe deserialization in
foreman-rake configuration

An attacker who can influence Foreman configuration can trigger
server-side template evaluation or unsafe deserialization during
foreman-rake startup, leading to code execution in a privileged
service context.

    Affects Foreman 1.0 through 3.19.1, and 5.0.0; the ERB
     execution path starts at 1.15.0
    CVSS: 7.7, CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H;
     vendor severity: Important
    CWE: CWE-502
    Fix released in Foreman 3.19.2 and 5.0.1
    Redmine issue: #39841
    GitHub PR 11310


CVE-2026-12545: Hammer CLI: editor command injection

A local attacker who can influence Hammer CLI’s editor configuration
can cause commands to execute when a user invokes the affected
editor flow. If Hammer CLI runs with elevated privileges, this can
result in privilege escalation.

    Affects Hammer CLI 0.15.1 through 3.19.0, and 5.0.0
    CVSS: 6.7, CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H;
     vendor severity: Moderate
    CWE: CWE-78
    Fix released in Hammer CLI 5.0.1 and 3.19.1
    Redmine issue: #39842
    GitHub PR 407


CVE-2026-56097: Katello: SQL injection in Registry Proxy labels

An authenticated low-privilege user can inject SQL through Katello
Registry Proxy label parameters because input is interpolated into
database queries without sufficient sanitization. This can expose
data across authorization boundaries.

    Affects Katello 4.13.0 through 4.21.1.1, and 5.0.0
    CVSS: 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N;
     vendor severity: Moderate
    CWE: CWE-89
    Fix released in Katello 5.0.1 and 4.21.2; master contains the fix
    Redmine issue: #39843
    GitHub PR 11887


CVE-2026-56098: Katello: Registry Proxy authorization bypass

An authenticated low-privilege user can bypass Registry Proxy
authorization checks and enumerate organizations and products
through response differences.

    Affects Katello 4.13.0 through 4.21.1.1, and 5.0.0
    CVSS: 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N;
     vendor severity: Moderate
    CWE: CWE-203
    Fix released in Katello 5.0.1 and 4.21.2; master contains
      the fix
    Redmine issue: #39844
    GitHub PR 11887


CVE-2026-96658: Foreman: Safemode bypass leading to RCE

A low-privilege user permitted to render supplied template content
can bypass Foreman’s Safemode restrictions and reach Ruby code
execution with Foreman service privileges.

    Affects Foreman releases bundling Safemode before 2.0.1,
     including Foreman 3.19.0, 3.19.1, and 5.0.0
    CVSS: 9.9, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H;
     vendor severity: Critical
    CWE: CWE-94
    Fix released in Foreman 3.19.2 and 5.0.1; verify Safemode
     2.0.1 or later is installed
    Redmine issue: #39845
    GitHub PR 68 and dependency update 69


CVE-2026-96659: Foreman: excessive Viewer permissions on preview

The Viewer role can access data through template preview beyond
intended authorization boundaries. In configurations where Safemode
is disabled or bypassed, this can lead to code execution as the
Foreman service account.

    Affects Foreman 1.9.0 through 3.19.1, and 5.0.0
    CVSS: 9.1, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L;
     vendor severity: Important
    CWE: CWE-267
    Fix released in Foreman 3.19.2 and 5.0.1
    Redmine issue: #39846
    GitHub PR 11310


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================