CVE-2026-12540

Katalog CVE

CVSS 8.2 · High EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada redhat satellite, theforeman foreman. Skor CVSS 3.1 8.2 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

Rincian

Terbit di NVD

1 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:74503 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:74504 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:74505 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:74506 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-12540 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2489969 issue tracking · mitigasi · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/10/07/9 advisory pihak ketiga