Theforeman Foreman vulnerabilities

• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-tail CVE-2026-12542 5.3 MediumOctober 1, 2026
• theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: excessive permissions for viewer role on preview CVE-2026-96659 9.1 CriticalOctober 1, 2026
• theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: foreman: arbitrary code execution via safemode sandbox bypass CVE-2026-96658 8.8 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: ssti and insecure deserialization in foreman-rake configuration CVE-2026-12544 7.7 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-rake database tasks CVE-2026-12541 8.2 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter CVE-2026-12540 8.2 HighOctober 1, 2026
• redhat satellite, theforeman foreman, red hat satellite 6 +5 more +7 more Foreman: unauthenticated information disclosure via provisioning token validation flaw CVE-2026-12423 7.5 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup CVE-2026-81658 6.5 MediumAugust 27, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: information disclosure via improper validation of nested request parameters CVE-2026-5138 4.3 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: unauthorized modification of host configurations via broken access control CVE-2026-5135 6.5 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass CVE-2026-5142 6.5 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation CVE-2026-5136 8.8 HighJuly 1, 2026
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config CVE-2026-13316 4.4 MediumJune 30, 2026
• theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 more Foreman-mcp-server: mcp server: insecure sensitive http header sanitization CVE-2026-9073 6.2 MediumJune 23, 2026
• theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 more Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse CVE-2026-12112 7.8 HighJune 23, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +4 more +6 more Forman: foreman: remote code execution via command injection in websocket proxy CVE-2026-1961 Public exploit 8.0 HighMarch 26, 2026
• redhat satellite, the foreman foreman, red hat satellite 6.15 for rhel 8 +6 more +8 more Foreman: satellite: graphql api permission bypass leads to information disclosure CVE-2025-9572 Fix available 5.0 MediumNovember 21, 2025
• theforeman foreman, red hat satellite 6 +1 more Foreman: command injection in "host init config" template via "install packages" field on foreman CVE-2024-7700 6.5 MediumAugust 12, 2024
• theforeman foreman, red hat satellite 6.13 for rhel 8, satellite 6.14 for rhel 8 +1 more +3 more Foreman: world readable file containing secrets CVE-2023-4886 6.7 MediumOctober 3, 2023
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Os command injection via ct_command and fcct_command CVE-2022-3874 8.0 HighSeptember 22, 2023
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Arbitrary code execution through yaml global parameters CVE-2023-0462 8.0 HighSeptember 20, 2023
• theforeman foreman, red hat satellite 6.11 for rhel 7, satellite 6.11 for rhel 8 +4 more +6 more Foreman: arbitrary code execution through templates CVE-2023-0118 9.1 CriticalSeptember 20, 2023
• the foreman foreman A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the... CVE-2021-20260 7.8 HighAugust 26, 2022
• the foreman foreman, redhat satellite +1 more A flaw was found in Foreman project. A credential leak was identified which will expose Azure... CVE-2021-3590 8.8 HighAugust 22, 2022
• theforeman foreman A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat... CVE-2020-10710 Fix available 4.4 MediumAugust 16, 2022
• theforeman foreman ansible, redhat satellite +1 more Missing Authentication for Critical Function in Foreman Ansible CVE-2021-3589 Fix available 8.0 HighMarch 23, 2022
• the foreman foreman, redhat satellite +1 more A server side remote code execution vulnerability was found in Foreman project. A authenticated... CVE-2021-3584 7.2 HighDecember 23, 2021
• the foreman foreman, theforeman foremanfogproxmox +1 more Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox CVE-2021-20259 Fix available 7.8 HighJune 7, 2021
• the foreman foreman Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling... CVE-2021-3469 5.4 MediumJune 3, 2021
• redhat satellite, satellite capsule, theforeman foreman ansible +2 more A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not... CVE-2020-10716 6.5 MediumMay 27, 2021
• the foreman foreman A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by... CVE-2021-3494 5.9 MediumApril 26, 2021
• [unknown] satellite, theforeman foreman azurerm +1 more A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A... CVE-2021-3413 6.3 MediumApril 8, 2021
• foreman Foreman has improper input validation which could lead to partial Denial of Service CVE-2014-0091 5.3 MediumDecember 11, 2019
• redhat satellite, the foreman foreman +1 more It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce... CVE-2014-8183 7.4 HighAugust 1, 2019
• the foreman project foreman-tasks, redhat satellite +1 more An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously,... CVE-2019-10198 6.5 MediumJuly 31, 2019
• the foreman foreman, redhat satellite +1 more In Foreman it was discovered that the delete compute resource operation, when executed from the... CVE-2019-3893 4.9 MediumApril 9, 2019
• the foreman foreman A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker... CVE-2018-16861 7.6 HighDecember 7, 2018
• [unknown] foreman A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability... CVE-2018-14664 5.4 MediumOctober 12, 2018
• theforeman foreman, [unknown] smart proxy dynflow +1 more smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature CVE-2018-14643 Fix available 9.8 CriticalSeptember 21, 2018
• foreman foreman before version 1.15.0 is vulnerable to an information leak through organizations and... CVE-2016-7078 4.3 MediumSeptember 10, 2018
• foreman foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper... CVE-2016-7077 4.3 MediumSeptember 10, 2018
• the foreman foreman, redhat satellite, satellite capsule +2 more It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or... CVE-2016-8639 6.1 MediumAugust 1, 2018
• the foreman foreman A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman... CVE-2016-8634 6.1 MediumAugust 1, 2018
• the foreman foreman A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH... CVE-2016-8613 6.4 MediumJuly 31, 2018
• foreman foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment... CVE-2017-7535 6.1 MediumJuly 26, 2018
• [unknown] foreman, redhat satellite +1 more A flaw was found in foreman before version 1.15 in the logging of adding and registering images.... CVE-2017-2672 6.5 MediumJune 21, 2018
• theforeman foreman, unspecified foreman-debug, redhat satellite +2 more foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An... CVE-2016-9593 4.7 MediumApril 16, 2018
• foreman project foreman, redhat satellite +1 more An input sanitization flaw was found in the id field in the dashboard controller of Foreman... CVE-2018-1096 6.5 MediumApril 5, 2018
• foreman project foreman, redhat satellite +1 more A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for... CVE-2018-1097 8.8 HighApril 4, 2018
• foreman project foreman, redhat satellite, satellite capsule +2 more An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on... CVE-2017-15100 6.1 MediumNovember 27, 2017
• Show olderLoading…