{"id":"CVE-2026-96658","aliases":[],"cve":{"records":[{"id":"CVE-2026-96658","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-23T14:46:49.272Z","published":"2026-10-01T16:23:23.688Z","modified":"2026-11-02T18:02:52.712Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-02T18:02:52.712Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-02T03:55:31.650Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-07T06:12:17.303Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/2","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-94","description":"Improper Control of Generation of Code","source":"redhat"},{"id":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-01T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Foreman: foreman: arbitrary code execution via safemode sandbox bypass","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.","score":8.8,"severity":"high","published":"2026-10-01T16:23:23.688Z","modified":"2026-11-02T18:02:52.712Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Satellite 6.16 for RHEL 8","platforms":[],"versions":[{"version":"0:1.5.0-2.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.16 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-2.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:3.14.0.22-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:3.2.13-1.el9pc","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:3.1.62-1.el9pc","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:5.3.1-2.el9pc","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:0.6.0-1.el9pc","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:15.0.2-2.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:3.14.0-2.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:4.16.0.20-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-2.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:6.17.12-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.17 for RHEL 9","platforms":[],"versions":[{"version":"0:0.1.0-2.1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.18 for RHEL 9","platforms":[],"versions":[{"version":"0:1.5.0-2.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"},{"vendor":"Red Hat","name":"Red Hat Satellite 6.19 for RHEL 9","platforms":[],"versions":[{"version":"0:3.18.0.14-1.el9sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"}],"references":["https://access.redhat.com/errata/RHSA-2026:74503","https://access.redhat.com/errata/RHSA-2026:74504","https://access.redhat.com/errata/RHSA-2026:74505","https://access.redhat.com/errata/RHSA-2026:74506","https://access.redhat.com/security/cve/CVE-2026-96658","https://bugzilla.redhat.com/show_bug.cgi?id=2534185","http://www.openwall.com/lists/oss-security/2026/10/07/2"],"sources":[{"name":"CVE","id":"CVE-2026-96658","modified":"2026-11-02T18:02:52.712Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-11-02T18:34:14.045Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:45:32.518Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-03T06:05:37.731Z","attemptedAt":"2026-11-03T06:05:37.731Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-03T06:05:37.734Z","attemptedAt":"2026-11-03T06:05:37.734Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-03T06:05:37.745Z","attemptedAt":"2026-11-03T06:05:37.745Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-03T06:05:37.745Z","attemptedAt":"2026-11-03T06:05:37.745Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-96658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658","modified":"2026-10-18T07:16:53.807","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-03T06:05:37.731Z"},{"source":"GitHub Advisory Database","id":"GHSA-g2wg-rx2f-4j5r","url":"https://github.com/advisories/GHSA-g2wg-rx2f-4j5r","modified":"2026-10-07T09:32:12Z","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-11-03T06:05:37.734Z"},{"source":"ENISA EUVD","id":"EUVD-2026-90921","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90921","modified":"Nov 2, 2026, 6:02:52 PM","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-03T06:05:37.745Z"},{"source":"FIRST EPSS","id":"CVE-2026-96658","url":"https://www.first.org/epss/","probability":0.00724,"percentile":0.54049,"date":"2026-11-02","checkedAt":"2026-11-03T06:05:37.745Z"}],"aiSummary":{"text":"A flaw in Foreman allows an authenticated remote attacker with low-level read permissions to bypass the safemode sandbox isolation. The vulnerability affects Red Hat Satellite, but the exact affected versions are unclear. An attacker can manipulate the permitted methods list within the template rendering engine to execute unauthorized commands.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-02T18:41:11.232Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96658"}]}}