CVE-2026-12544
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
- Published Oct 1, 2026
- CVSS 7.7 high
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available