CVE-2026-12540 is a command injection vulnerability in Foreman's foreman-rake errors:fetch_log task. The request_id parameter is used in an underlying system command (commonly grep) without proper shell neutralization, enabling an attacker with sudo privileges to inject shell metacharacters such as ;, ", or | to break out of the intended command context and execute arbitrary code. This vulnerability is part of a set of command injection and other security issues fixed in Red Hat Satellite 6.19.5 for RHEL 9. The vulnerability has a CVSS v3.1 base score of 8.2, indicating high severity with impacts on confidentiality, integrity, and availability.

An attacker with sudo permissions to execute the foreman-rake errors:fetch_log task can exploit this vulnerability to execute arbitrary code on the system. This can lead to full system compromise, including unauthorized access, data modification, and service disruption. The vulnerability affects Red Hat Satellite 6.19 on RHEL 9, which is used for system provisioning and configuration management.

Red Hat has released an official security update (RHSA-2026:74503) that patches this vulnerability in Red Hat Satellite 6.19 for RHEL 9. Users should apply this update promptly to remediate the issue. Prior to applying the update, ensure all previously released errata relevant to the system have been applied. No additional mitigation steps are required beyond applying the official patch.