CVE-2026-12544 Red Hat — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.7 (HIGH)
Affected Versions	6.16 — 6.19.5
Fixed In	6.16.4
Type	CWE-502 (Deserialization of Untrusted Data)
Vendor	Red Hat
Public PoC	No

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization.

This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.

Attack Parameters

Attack Vector

Local

Requires local access

Attack Complexity

Low

Easy to exploit

Privileges Required

High

Admin privileges needed

User Interaction

Required

User action required

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-502 Deserialization of Untrusted Data

Vulnerable Products 11

Configuration	From (including)	Up to (excluding)
Redhat Satellite cpe:2.3:a:redhat:satellite:6.0:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.16`	`6.16.4`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	—	—
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.17`	`6.17.12`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.19`	`6.19.5`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—
Theforeman Foreman cpe:2.3:a:theforeman:foreman:-:::::::*	—	—
Redhat Satellite cpe:2.3:a:redhat:satellite::::::::	`6.18`	`6.18.10`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	—	—