CVE-2026-12541

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.

• CWE-78

• https://access.redhat.com/errata/RHSA-2026:74503Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:74504Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:74505Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:74506Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-12541Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2489970Issue Tracking, Mitigation, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/10/07/8Third Party Advisory

Published

Oct 1, 2026

Last Modified

Oct 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12536The Avada (Fusion) Builder plugin for WordPress is vulnerabl…6.4
• CVE-2026-12537Improper Neutralization used in an OS Command in the contain…7.8
• CVE-2026-12538IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1…5.4
• CVE-2026-12539Docker Sandboxes (sbx) blocks ICMP egress with an authorizer…5.7
• CVE-2026-1254The Modula Image Gallery – Photo Grid & Video Gallery plugin…4.3
• CVE-2026-12540A flaw was found in Foreman. A command injection vulnerabili…8.2
• CVE-2026-12542A flaw was found in Foreman. The foreman-tail utility is vul…7.8
• CVE-2026-12544A flaw was found in Foreman. The foreman-rake initialization…7.7
• CVE-2026-12545A flaw was found in rubygem-hammer_cli. A command injection …6.7
• CVE-2026-12547SoupAuthManager caches proxy authentication credentials with…3.4
• CVE-2026-12548A heap out-of-bounds read flaw was found in libsoup. When pa…4.2
• CVE-2026-12549The fix for CVE-2026-2443 was regressed by a subsequent rewo…4.8