{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.23-1.el8sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.23-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.22-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.25-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","product":"Red Hat Satellite 6.19 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.18.0.14-1.el9sat","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"satellite:el8/foreman","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-12542","cwes":["CWE-78"],"description":"A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.","epss":{"date":"2026-11-02","percentile":0.46834,"score":0.00563},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793645341393,"publishedAt":1790874889985,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74503"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74504"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74505"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:74506"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-12542"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/07/7"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}],"revision":"fa789beaa282a6339c6804a9cccde1b1a308e1ba76fc188a8f0acbaac64aa4b6","sources":[{"modifiedAt":1793645341393,"name":"CNA: redhat","retrievedAt":1793646544043,"url":"https://www.cve.org/CVERecord?id=CVE-2026-12542"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793646553821,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12542"}],"ssvc":null,"status":"published","title":"Foreman: command injection in foreman-tail","updatedAt":1793646553821}