CVE-2026-12540

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description A command injection flaw exists in the foreman-rake errors:fetch log task. The request id parameter is passed to an underlying system command, typically grep, without adequate shell neutralization. An attacker with sudo permissions to execute this rake task can inject shell metacharacters, such as ;, ", or |, to bypass the intended command and execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.