Theforeman Foreman vulnerabilities, page 5
84 vulnerabilities
Known vulnerabilities in Theforeman Foreman, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2026-12423redhat · satellite +1 moreForeman: unauthenticated information disclosure via provisioning token validation flawA flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.EPSS0.36%HighCVE-2026-12541redhat · satellite +1 moreForeman: command injection in foreman-rake database tasksA flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.EPSS1.20%CriticalCVE-2023-0462redhat · satellite +1 moreArbitrary code execution through yaml global parametersAn arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.EPSS0.96%MediumCVE-2023-4886redhat · satellite +1 moreForeman: world readable file containing secretsA sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.EPSS0.29%