CVE-2026-12542 is a command injection flaw in the foreman-tail utility in Foreman and Red Hat Satellite. A local attacker can run arbitrary commands through unsanitized arguments. Red Hat scores it 5.3 Medium, while NVD scores it 7.8. Apply the vendor update as soon as you can.
What's affected
- Foreman (theforeman foreman), Red Hat Satellite and Red Hat Enterprise Linux are listed as affected products in the record.
- The record points to four Red Hat errata: RHSA-2026:74503, 74504, 74505 and 74506. The Red Hat CVE page I fetched does not list fixed package versions, so use the errata that match your Satellite or RHEL stream.
- The attacker must be local with low privileges.
Source conflict: the record and Red Hat score this 5.3 Medium (vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The Red Hat page notes that NVD scores it 7.8. Both numbers are shown here, and you should decide on urgency using your own exposure.
How to check if you're exposed
The utility is local, so the question is who has shell access on your Foreman or Satellite servers.
rpm -qa | grep -i foreman
rpm -qf $(command -v foreman-tail)
The second command shows which package owns the script. Compare its version with the package versions in the Red Hat errata for your release. On non-RHEL Foreman installs, check the Foreman project's own release notes, which I did not fetch.
What to do now
- Find every Foreman and Satellite server and who has shell access to it.
- Apply the matching Red Hat errata, or the upstream Foreman fix if you run community Foreman.
- Red Hat says it has not identified a practical mitigation, so avoid relying on one.
- Until you patch, avoid passing untrusted text to foreman-tail in scripts or wrappers.
Why it matters
The record maps this to CWE-78 (OS Command Injection). According to the description, the script builds a string from user-supplied arguments and runs it through the shell command eval to expand file paths. Since the input is neither quoted nor sanitized, shell metacharacters in an argument are interpreted as commands.
This is a classic pattern, and the fix is usually to stop building a command string from input. The reason scores differ is context: a local, low privilege attacker is a smaller audience than a remote one, but on a shared management host it can still lead to privilege gain. The CVE is not in the CISA KEV catalog and the record does not report exploitation.
Quick check
Why do Red Hat and NVD scores differ?
Red Hat rates it 5.3 Medium. NVD rates it 7.8. Different assumptions about impact can produce different scores, so the post shows both.
Does it need network access?
No. The vector is local, with low privileges required.
Sources
Last reviewed: 18 October 2026.
