CVE-2026-12544

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description A flaw exists in the foreman-rake initialization logic located in /usr/share/foreman/config/settings.rb. The issue stems from a code pattern where configuration data is processed through two separate executable layers, creating a multi-stage execution chain. This allows for Server-Side Template Injection (SSTI)—where an attacker injects malicious templates that are executed on the server—and insecure deserialization—where untrusted data is used to abuse the logic of an application to execute arbitrary code. This can result in remote code execution, total infrastructure compromise, and supply chain risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.