A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. (CVE-2026-12542)
Foreman contains a vulnerability in the foreman-tail utility where unsafe use of the eval command allows local attackers to perform OS command injection. This occurs because user-supplied arguments are directly incorporated into a string executed by eval without proper sanitization or quoting, enabling injection of shell metacharacters to execute arbitrary system commands. The vulnerability has a CVSS score of 5.3 (medium severity). Red Hat has issued a security advisory with a patch for this issue as part of Red Hat Satellite 6.19 updates.
AI Analysis
Technical Summary
The foreman-tail utility in Foreman is vulnerable to OS command injection due to unsafe use of the eval command. User input is directly embedded into a command string executed by eval without sanitization, allowing local attackers to inject shell metacharacters and execute arbitrary system commands. This vulnerability is tracked as CVE-2026-12542 and has a CVSS 3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Red Hat's advisory RHSA-2026:74503 includes a fix for this vulnerability as part of updates to Red Hat Satellite 6.19.
Potential Impact
A local attacker with the ability to supply arguments to foreman-tail can execute arbitrary system commands with the privileges of the foreman-tail process. This can lead to limited confidentiality, integrity, and availability impacts on the affected system. The attack requires local access and low complexity but no user interaction. The vulnerability is rated medium severity with a CVSS score of 5.3.
Mitigation Recommendations
A security update fixing this vulnerability is available from Red Hat as part of Red Hat Satellite 6.19 updates (RHSA-2026:74503). Applying this official patch will remediate the command injection flaw in foreman-tail. Users should ensure all relevant errata are applied before updating. No additional mitigation steps are required once the patch is applied.
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. (CVE-2026-12542)
Description
Foreman contains a vulnerability in the foreman-tail utility where unsafe use of the eval command allows local attackers to perform OS command injection. This occurs because user-supplied arguments are directly incorporated into a string executed by eval without proper sanitization or quoting, enabling injection of shell metacharacters to execute arbitrary system commands. The vulnerability has a CVSS score of 5.3 (medium severity). Red Hat has issued a security advisory with a patch for this issue as part of Red Hat Satellite 6.19 updates.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The foreman-tail utility in Foreman is vulnerable to OS command injection due to unsafe use of the eval command. User input is directly embedded into a command string executed by eval without sanitization, allowing local attackers to inject shell metacharacters and execute arbitrary system commands. This vulnerability is tracked as CVE-2026-12542 and has a CVSS 3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Red Hat's advisory RHSA-2026:74503 includes a fix for this vulnerability as part of updates to Red Hat Satellite 6.19.
Potential Impact
A local attacker with the ability to supply arguments to foreman-tail can execute arbitrary system commands with the privileges of the foreman-tail process. This can lead to limited confidentiality, integrity, and availability impacts on the affected system. The attack requires local access and low complexity but no user interaction. The vulnerability is rated medium severity with a CVSS score of 5.3.
Mitigation Recommendations
A security update fixing this vulnerability is available from Red Hat as part of Red Hat Satellite 6.19 updates (RHSA-2026:74503). Applying this official patch will remediate the command injection flaw in foreman-tail. Users should ensure all relevant errata are applied before updating. No additional mitigation steps are required once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-79jg-9wx4-f5rr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-12542"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6abeb3e1a43b0b3b89ecca71
Added to database: 10/01/2026, 19:26:25 UTC
Last enriched: 10/01/2026, 19:27:40 UTC
Last updated: 10/02/2026, 02:45:56 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.