CVE-2026-96658: Foreman: safemode bypass leading to RCE
CVE-2026-96658 affects Foreman and Red Hat Satellite. The record describes an authenticated user with low-level read permissions who can bypass the safemode sandbox of the template rendering engine and run commands on the host. Red Hat rates it 8.8 (high) and the record classifies it as CWE-94 (code injection), but no confirmed exploitation appears in the sources consulted and it is not listed in CISA KEV.
Overview
CVE-2026-96658 is a flaw in Foreman described as a safemode bypass in the template rendering engine. The record states that an authenticated remote attacker with low-level read permissions can manipulate the permitted methods list and escape the sandbox isolation to run unauthorized commands on the host. The weakness is classified as CWE-94 (Code Injection). The record also lists Red Hat Satellite among the affected products.
Impact
The record describes arbitrary code execution on the underlying server. Red Hat's CVSS base score is 8.8, with high confidentiality, integrity and availability impact. The GitHub Security Advisory lists a 9.9 score among the aggregated scores. The SSVC data in the record lists technical impact as total, exploitation as none and automatable as no.
Affected products and versions
- Theforeman Foreman: the record lists versions before 2.0.1, 3.19.0, 3.19.1 and 5.0.0.
- Red Hat Satellite: ranges from 6.16 up to before 6.16.4, from 6.17 up to before 6.17.12, from 6.18 up to before 6.18.10, and from 6.19 up to before 6.19.5.
- Several Red Hat Satellite product entries are listed for specific RHEL-targeted builds without version details.
The record does not describe which versions between the listed points are affected.
Exploitation status
The record shows this CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00685 with a percentile of 0.52069 as of 2026-10-23.
Remediation and mitigation
- Apply the Red Hat Satellite errata listed in the references: RHSA-2026:74503, RHSA-2026:74504, RHSA-2026:74505 and RHSA-2026:74506. See Red Hat CVE page.
- For Foreman, review the patch referenced on the oss-security mailing list and upgrade to a release outside the affected ranges.
- Restrict which accounts hold read permissions in the application, following least privilege, since the described attacker needs an authenticated low-privilege account.
- Check the vendor advisories for the exact fixed build for your product line.
Detection guidance
- Review application and audit logs for template-related actions performed by low-privilege accounts that are unusual for their role.
- Monitor Foreman or Satellite hosts for unexpected child processes started by the web application service.
- Track changes to permitted-method configuration and to template content.
Limitations of the available information
The record does not state an explicit fixed version for Foreman, although the listed ranges imply where the issue ends. The Red Hat fixed boundaries are inferred from the upper limits of the ranges, not stated directly. No exploitation details beyond the description are provided, and no proof of concept is cited in the record.
Frequently asked questions
Is CVE-2026-96658 being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Given the high severity, it should still be treated as a patching priority.
Which products are affected?
The record lists Foreman versions before 2.0.1, 3.19.0, 3.19.1 and 5.0.0. It also lists Red Hat Satellite ranges from 6.16 up to before 6.16.4, from 6.17 up to before 6.17.12, from 6.18 up to before 6.18.10 and from 6.19 up to before 6.19.5.
What access does an attacker need?
According to the record, the attacker must be authenticated and hold low-level read permissions.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.