CRITICAL 9.9 NVD
CVE-2026-96658
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox with
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
References
- https://access.redhat.com/errata/RHSA-2026:74503
- https://access.redhat.com/security/cve/CVE-2026-96658
- https://bugzilla.redhat.com/show_bug.cgi?id=2534185
This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-10-01 via NVD.
Risk Timeline
CVE Disclosed2026-10-01 · -1 days ago
Remediation Resources
Official Advisory
access.redhat.com/errata/RHSA-2026:74503Official Advisory
access.redhat.com/security/cve/CVE-2026-96658Analysis & PoC
bugzilla.redhat.com/show_bug.cgi?id=2534185
vulnfeed aggregates 9446 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.