Theforeman vulnerabilities
We track 11 vulnerabilities in Theforeman products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 1, 2026.
Latest Theforeman vulnerabilities
- 7.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand
- 9.1 Critical severity
Red Hat Satellite 6.16 for RHEL 8: Privilege Defined With Unsafe Actions
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sens
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Control of Generation of Code
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engin
- 7.7 High severity
Red Hat Satellite 6.16 for RHEL 8: Deserialization of Untrusted Data
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution ch
- 8.2 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (d
- 8.2 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intend
- 7.5 High severity
Red Hat Satellite 6.16 for RHEL 8: Missing Authentication for Critical Functionality
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than it
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Incorrect Privilege Assignment
A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including adminis
- 7.8 High severity
Red Hat Satellite 6.18: Improper Authentication
A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret se
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when cons
- 9.1 Critical severity
Red Hat Satellite 6.11 for RHEL 7: Improper Neutralization of Special Elements used in an OS Command
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.