CVE-2026-12540 Red Hat — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	8.2 (HIGH)
Affected Versions	6.16 — 6.19.5
Fixed In	6.16.4
Type	CWE-78 (OS Command Injection)
Vendor	Red Hat
Public PoC	No

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.

While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

Attack Parameters

Attack Vector

Local

Requires local access

Attack Complexity

Low

Easy to exploit

Privileges Required

High

Admin privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-78 OS Command Injection

Vulnerable Products 11

Configuration	From (including)	Up to (excluding)
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.16`	`6.16.4`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	—	—
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.17`	`6.17.12`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.19`	`6.19.5`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Theforeman Foreman cpe:2.3:a:theforeman:foreman:-:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.18`	`6.18.10`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite:6.0:::::::*	—	—