CVE-2026-12542: Red Hat Satellite 6

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Affected products

• Red Hat Red Hat Satellite 6
• Red Hat Red Hat Satellite 6.16 For Rhel 8: before 0:3.12.0.23-1.el8sat (fixed in 0:3.12.0.23-1.el8sat)
• Red Hat Red Hat Satellite 6.16 For Rhel 9: before 0:3.12.0.23-1.el9sat (fixed in 0:3.12.0.23-1.el9sat)
• Red Hat Red Hat Satellite 6.17 For Rhel 9: before 0:3.14.0.22-1.el9sat (fixed in 0:3.14.0.22-1.el9sat)
• Red Hat Red Hat Satellite 6.18 For Rhel 9: before 0:3.16.0.25-1.el9sat (fixed in 0:3.16.0.25-1.el9sat)
• Red Hat Red Hat Satellite 6.19 For Rhel 9: before 0:3.18.0.14-1.el9sat (fixed in 0:3.18.0.14-1.el9sat)

Published 2026-10-01. Last modified 2026-10-07.