CVE-2026-12541 is an OS command injection vulnerability in Foreman, specifically in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ruby system() call. An attacker with permissions to execute foreman-rake (such as via restricted sudo) can append malicious shell commands to these file paths, potentially leading to full system compromise. Red Hat has issued a security advisory (RHSA-2026:74503) providing patches for Red Hat Satellite 6.19 on RHEL 9 to remediate this issue.

Successful exploitation allows an attacker with foreman-rake execution permissions to execute arbitrary OS commands with elevated privileges, leading to complete system compromise including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.2 (High), reflecting high impact on confidentiality, integrity, and availability.

A security update is available from Red Hat (RHSA-2026:74503) that fixes this vulnerability. Users of Red Hat Satellite 6.19 on RHEL 9 should apply the update promptly. No additional mitigation steps are required beyond applying the official patch. Ensure that only trusted users have permissions to execute foreman-rake tasks.