CVE-2026-96658

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96658
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96658
Downstream
RHSA (4)
Published
2026-10-01T16:23:23Z
Modified
2026-10-24T10:51:19Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
Details

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96658.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0:1.5.0-2.el8sat"
                        },
                        {
                            "fixed":  "0:1.5.0-2.el9sat"
                        },
                        {
                            "fixed":  "0:3.14.0.22-1.el9sat"
                        },
                        {
                            "fixed":  "0:3.2.13-1.el9pc"
                        },
                        {
                            "fixed":  "0:3.1.62-1.el9pc"
                        },
                        {
                            "fixed":  "0:5.3.1-2.el9pc"
                        },
                        {
                            "fixed":  "0:0.6.0-1.el9pc"
                        },
                        {
                            "fixed":  "0:15.0.2-2.el9sat"
                        },
                        {
                            "fixed":  "0:3.14.0-2.el9sat"
                        },
                        {
                            "fixed":  "0:4.16.0.20-1.el9sat"
                        },
                        {
                            "fixed":  "0:1.5.0-2.el9sat"
                        },
                        {
                            "fixed":  "0:6.17.12-1.el9sat"
                        },
                        {
                            "fixed":  "0:0.1.0-2.1.el9sat"
                        },
                        {
                            "fixed":  "0:1.5.0-2.el9sat"
                        },
                        {
                            "fixed":  "0:3.18.0.14-1.el9sat"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git
github.com/theforeman/foreman

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/foreman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a7d8400d08c6710a784b4703c662e56bf5a47671
Introduced
d82d6878ac1683790d4ea1e54772e2f047d4254a
Last Affected
092a456bdea31af4e91d7088856bd67aaff64c25
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.0.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.19.0"
                },
                {
                    "last_affected":  "3.19.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.19.1"
                },
                {
                    "last_affected":  "3.19.1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "5.0.0"
                },
                {
                    "last_affected":  "5.0.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

0.*
0.1-1
0.1-2
0.1-3
0.1-4
0.1-5
0.1-6
0.2
0.2rc1
0.3
0.4
0.4rc2
0.4rc3
0.4rc4
0.4rc5
1.*
1.0
1.0RC1
1.0RC2
1.0RC3
1.0RC4
1.0RC5
1.1
1.1RC1
1.1RC2
1.1RC3
1.1RC4
1.1RC5
2.*
2.0.0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
3.*
3.19.0
3.19.1
5.*
5.0.0
5.0.0-rc1
5.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"
github.com/theforeman/foreman-installer

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/foreman-installer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dcc764bed9867eae7b78f1c7b395199583bba5e9
Introduced
c08fe88ada05e9b7fb6f1c4a24d2939f47c7e5c7
Last Affected
e081fe7c568a5e597c0b9b6cfb025abf36edc2ff
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.0.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.19.0"
                },
                {
                    "last_affected":  "3.19.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.19.1"
                },
                {
                    "last_affected":  "3.19.1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "5.0.0"
                },
                {
                    "last_affected":  "5.0.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*
1.0.1
2.*
2.0.0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
3.*
3.19.0
3.19.1
5.*
5.0.0
5.0.0-rc1
5.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"
github.com/theforeman/smart-proxy

Affected ranges

Type
GIT
Repo
https://github.com/theforeman/smart-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
67dde61f6894010ed862c1c99060bdcfba727269
Introduced
8b7a6d6c5955634c2bff9d8789234b0d7c3fe616
Last Affected
e63094f9ee6794882fabc2889877372459bf7072
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.0.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:3.19.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.19.0"
                },
                {
                    "last_affected":  "3.19.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:3.19.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.19.1"
                },
                {
                    "last_affected":  "3.19.1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:theforeman:foreman:5.0.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "5.0.0"
                },
                {
                    "last_affected":  "5.0.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

0.*
0.1
0.2
0.2rc2
0.3
1.*
1.0
1.0RC1
1.0RC2
1.1
1.1RC1
1.1RC2
1.1RC3
2.*
2.0.0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
3.*
3.19.0
3.19.1
5.*
5.0.0
5.0.0-rc1
5.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96658.json"