CVE-2026-12544 is a vulnerability in Foreman where the foreman-rake initialization logic processes configuration data through two executable layers, enabling Server-Side Template Injection and insecure deserialization. This multi-stage execution chain can be exploited to achieve remote code execution and compromise the entire infrastructure. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.7. Red Hat’s advisory (RHSA-2026:74503) confirms the issue and provides patches for Red Hat Satellite 6.19 on RHEL 9.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the affected system. This can result in total infrastructure compromise and poses a supply chain risk. The vulnerability affects critical components of Foreman used in system management and provisioning.

An official patch is available from Red Hat as detailed in their security advisory RHSA-2026:74503. Users of Red Hat Satellite 6.19 on RHEL 9 should apply the update promptly. The advisory includes instructions for updating and notes that all previously released errata should be applied before this update. No additional mitigation steps are required beyond applying the official fix.