CVE-2026-12544

Katalog CVE

CVSS 7.7 · High EPSS 0,21%

Kerentanan Deserialization of Untrusted Data pada redhat satellite, theforeman foreman. Skor CVSS 3.1 7.7 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Rincian

Terbit di NVD

1 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:74503 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:74504 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:74505 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:74506 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-12544 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2489992 issue tracking · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/10/07/6 advisory pihak ketiga