High severity · published Oct 1, 2026
CVE-2026-96658
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Satellite 6.16 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.16 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.17 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.18 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.19 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
FO
Foreman · Theforeman
before 2.0.1; 3.19.0; 3.19.1; 5.0.0 · source: NVD
SA
Satellite · Redhat
6.16 before 6.16.4; 6.17 before 6.17.12; 6.19 before 6.19.5; 6.18 before 6.18.10 · source: NVD
Affected product
RH
Red Hat Satellite 6.16 for RHEL 8
Red Hat
More from Red Hat Satellite 6.16 for RHEL 8
9.8
CVE-2024-7923
Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
9.8
CVE-2024-7012
Puppet-foreman: an authentication bypass vulnerability exists in foreman
9.6
CVE-2026-39821
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
9.1
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
9.1
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing