{"id":"CVE-2026-96658","summary":"Foreman: foreman: arbitrary code execution via safemode sandbox bypass","details":"A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.","modified":"2026-10-24T10:51:19.479524013Z","published":"2026-10-01T16:23:23.688Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96658.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"0:1.5.0-2.el8sat"},{"fixed":"0:1.5.0-2.el9sat"},{"fixed":"0:3.14.0.22-1.el9sat"},{"fixed":"0:3.2.13-1.el9pc"},{"fixed":"0:3.1.62-1.el9pc"},{"fixed":"0:5.3.1-2.el9pc"},{"fixed":"0:0.6.0-1.el9pc"},{"fixed":"0:15.0.2-2.el9sat"},{"fixed":"0:3.14.0-2.el9sat"},{"fixed":"0:4.16.0.20-1.el9sat"},{"fixed":"0:1.5.0-2.el9sat"},{"fixed":"0:6.17.12-1.el9sat"},{"fixed":"0:0.1.0-2.1.el9sat"},{"fixed":"0:1.5.0-2.el9sat"},{"fixed":"0:3.18.0.14-1.el9sat"}],"source":"AFFECTED_FIELD","strategy":"InverseAffectedRanges"}]}],"cna_assigner":"redhat"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/07/2"},{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74503"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74504"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74505"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:74506"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-96658"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96658.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman","events":[{"introduced":"0"},{"fixed":"a7d8400d08c6710a784b4703c662e56bf5a47671"},{"introduced":"d82d6878ac1683790d4ea1e54772e2f047d4254a"},{"last_affected":"092a456bdea31af4e91d7088856bd67aaff64c25"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"2.0.1"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*","range":[{"introduced":"3.19.0"},{"last_affected":"3.19.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*","range":[{"introduced":"3.19.1"},{"last_affected":"3.19.1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*","range":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"}]}]}}],"versions":["3.19.0","3.19.1","5.0.0","5.0.0-rc2","5.0.0-rc1","2.0.0","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","1.1","1.1RC5","1.1RC4","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC5","1.0RC4","1.0RC3","1.0RC2","1.0RC1","0.4","0.4rc5","0.4rc4","0.4rc3","0.4rc2","0.3","0.2","0.2rc1","0.1-6","0.1-5","0.1-4","0.1-3","0.1-2","0.1-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman-installer","events":[{"introduced":"0"},{"fixed":"dcc764bed9867eae7b78f1c7b395199583bba5e9"},{"introduced":"c08fe88ada05e9b7fb6f1c4a24d2939f47c7e5c7"},{"last_affected":"e081fe7c568a5e597c0b9b6cfb025abf36edc2ff"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"2.0.1"}]},{"cpe":"cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*","range":[{"introduced":"3.19.0"},{"last_affected":"3.19.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"3.19.1"},{"last_affected":"3.19.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*","range":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"}],"source":"CPE_STRING"}]}}],"versions":["3.19.0","3.19.1","5.0.0","5.0.0-rc2","5.0.0-rc1","2.0.0","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/smart-proxy","events":[{"introduced":"0"},{"fixed":"67dde61f6894010ed862c1c99060bdcfba727269"},{"introduced":"8b7a6d6c5955634c2bff9d8789234b0d7c3fe616"},{"last_affected":"e63094f9ee6794882fabc2889877372459bf7072"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"2.0.1"}]},{"cpe":"cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*","range":[{"introduced":"3.19.0"},{"last_affected":"3.19.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*","range":[{"introduced":"3.19.1"},{"last_affected":"3.19.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*","range":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"}],"source":"CPE_STRING"}]}}],"versions":["3.19.0","3.19.1","5.0.0","5.0.0-rc2","5.0.0-rc1","2.0.0","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","1.1","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC2","1.0RC1","0.3","0.2","0.2rc2","0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}