[ CVE-2026-96658 · Published 1 Oct 2026 ]
Vulnerability in Red Hat Satellite 6.16 for RHEL 8
CVSS 8.8
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
[ Fixes ]Fixes and patches
- Patch on openwall.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-3712
Foreman: Multiple vulnerabilities Translated from German
[ References ]References
- access.redhat.com/errata/RHSA-2026:74503Vendor Advisory
- access.redhat.com/errata/RHSA-2026:74504Vendor Advisory
- access.redhat.com/errata/RHSA-2026:74505Vendor Advisory
- access.redhat.com/errata/RHSA-2026:74506Vendor Advisory
- access.redhat.com/security/cve/CVE-2026-96658Vendor Advisory
- bugzilla.redhat.com/show_bug.cgiIssue TrackingVendor Advisory
- www.openwall.com/lists/oss-security/2026/10/07/2Mailing ListPatchThird Party Advisory