CVE-2026-96658 is a high severity (CVSS 8.8) code injection flaw in Foreman, which Red Hat Satellite includes. An authenticated attacker with low level read permissions can bypass the template safemode sandbox and run commands on the server. Red Hat shipped fixes in Satellite async updates.
What's affected
The record lists Foreman, Red Hat Satellite and Red Hat Enterprise Linux as affected products. The weakness is CWE-94, code injection. Red Hat's errata name the fixed Satellite releases: 6.19.5 (RHSA-2026:74503), 6.18.10 (RHSA-2026:74504) and 6.17.12 (RHSA-2026:74505). The record also cites RHSA-2026:74506, which I did not read, so check it for any other stream.
Per the record, an attacker manipulates the permitted methods list in the template rendering engine to escape the safemode sandbox, then executes commands on the host. The attack needs a login with low level read permissions.
Where sources differ. The record scores the CVE 8.8 high. Red Hat's errata are labeled Critical, but that label covers the whole async update, which bundles fixes for many components. Use the CVE's own score for this issue. I did not find a fixed upstream Foreman version in the pages I read, so check the Foreman project for that.
How to check if you're exposed
On Satellite servers, check the installed release.
rpm -q satellite foreman
Compare with the fixed releases above: Satellite 6.19.5, 6.18.10 or 6.17.12, depending on your stream. For upstream Foreman installs, check the project's security announcements for the fixed version.
Then list who has accounts. The flaw needs only low level read permissions, so every user with any access to templates and previews matters, including service accounts and integrations.
What to do now
- Apply the Red Hat Satellite async update for your stream: 6.19.5, 6.18.10 or 6.17.12.
- For upstream Foreman, check the project's advisory for the fixed release and upgrade.
- Review accounts with read access, remove ones you do not need, and rotate tokens for integrations.
- Limit network access to the Foreman or Satellite web interface and API to administrator networks.
- After patching, review the server for unexpected files, scheduled tasks and outbound connections made during the exposure window.
Why it matters
Template engines that run in safemode try to let users write templates while blocking dangerous calls. They work by allowing a list of methods. If someone can influence the list, the sandbox stops being a boundary. CWE-94 fits: the application builds executable behavior from input and the control that should limit it can be changed.
For a provisioning and patch management server, the stakes are high. Satellite and Foreman hold credentials and push configuration to many hosts, so code execution on that server can spread. The record does not mark exploitation and the CVE is not in CISA's catalog. Patch quickly because low privilege access is enough.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need administrator rights to exploit it?
No. The record says an authenticated attacker with low level read permissions can do it.
Which Satellite versions have the fix?
Red Hat's errata name 6.19.5, 6.18.10 and 6.17.12 for their streams.
Sources
Last reviewed: 18 October 2026.
