CVE-2026-12541: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Satellite 6.19 for RHEL 9
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
CVE-2026-12541: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Satellite 6.19 for RHEL 9
Description
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
CVSS v3.1
Score 8.2high
Affected software
Red Hat
Red Hat Satellite 6.19 for RHEL 9
Red Hat
Red Hat Satellite 6
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-17T17:41:21.684Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:74503","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","vendor":"Red Hat"}]
Threat ID: 6abe8af8a43b0b3b89c7babf
Added to database: 10/01/2026, 16:31:52 UTC
Last updated: 10/01/2026, 16:31:52 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.