{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-96658","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-09-23T14:46:49.272Z","datePublished":"2026-10-01T16:23:23.688Z","dateUpdated":"2026-11-02T18:02:52.712Z"},"containers":{"cna":{"title":"Foreman: foreman: arbitrary code execution via safemode sandbox bypass","metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.5.0-2.el8sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.5.0-2.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.14.0.22-1.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-dynaconf","defaultStatus":"affected","versions":[{"version":"0:3.2.13-1.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-gitpython","defaultStatus":"affected","versions":[{"version":"0:3.1.62-1.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-lxml","defaultStatus":"affected","versions":[{"version":"0:5.3.1-2.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-sqlparse","defaultStatus":"affected","versions":[{"version":"0:0.6.0-1.el9pc","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-foreman_remote_execution","defaultStatus":"affected","versions":[{"version":"0:15.0.2-2.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-hammer_cli","defaultStatus":"affected","versions":[{"version":"0:3.14.0-2.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-katello","defaultStatus":"affected","versions":[{"version":"0:4.16.0.20-1.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.5.0-2.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"satellite","defaultStatus":"affected","versions":[{"version":"0:6.17.12-1.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"yggdrasil-worker-forwarder","defaultStatus":"affected","versions":[{"version":"0:0.1.0-2.1.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.5.0-2.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.19 for RHEL 9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.18.0.14-1.el9sat","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74503","name":"RHSA-2026:74503","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","name":"RHSA-2026:74504","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","name":"RHSA-2026:74505","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","name":"RHSA-2026:74506","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","name":"RHBZ#2534185","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-10-01T00:00:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"Improper Control of Generation of Code","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-94: Improper Control of Generation of Code","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-09-15T18:42:29.604Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-01T00:00:00.000Z","value":"Made public."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-11-02T18:02:52.712Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-94","lang":"en","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-96658"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T03:55:31.650Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/2"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-07T06:12:17.303Z"}}]}}