{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aforemanforeman/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:foreman:foreman:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-96658"},{"cvss":9.1,"id":"CVE-2026-96659"},{"cvss":8.2,"id":"CVE-2026-12540"},{"cvss":7.7,"id":"CVE-2026-12544"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Foreman"],"_cs_severities":["critical"],"_cs_tags":["rce","vulnerability","webserver","information-disclosure","command-injection","foreman"],"_cs_type":"advisory","_cs_vendors":["Foreman"],"content_html":"\u003cp\u003eCVE-2026-96658 is a critical security vulnerability impacting Foreman, a lifecycle management tool for physical and virtual servers. The flaw exists within the application's templating engine, specifically regarding the implementation of the safemode sandbox designed to restrict untrusted code execution.\u003c/p\u003e\n\u003cp\u003eThe vulnerability allows an authenticated attacker with low-level permissions to manipulate the templating engine by abusing the handling of delegated methods. By appending unauthorized functions to the application's allowed execution list, the attacker can break out of the sandbox environment. This results in the ability to execute arbitrary commands with the privileges of the underlying web server process. Given the core management capabilities of Foreman, successful exploitation provides a significant vector for full infrastructure compromise. Defenders should prioritize updating Foreman instances to the latest patched version once available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated attackers to move from low-level access to full remote code execution on the hosting server. This capability enables complete control over the Foreman instance, potential lateral movement into managed compute nodes, and access to stored credentials or system configuration data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching Foreman as soon as the vendor releases the security update addressing CVE-2026-96658. Until a patch is available, audit user access levels and restrict template management permissions to trusted administrative roles to minimize the pool of potential attackers.\u003c/p\u003e\n","date_modified":"2026-10-02T14:20:35Z","date_published":"2026-10-01T18:12:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-foreman-rce/","summary":"An authenticated, low-privileged attacker can achieve remote code execution in Foreman by bypassing the templating engine's safemode sandbox to invoke unauthorized functions.","title":"Remote Code Execution in Foreman via Safemode Sandbox Bypass","url":"https://feed.craftedsignal.io/briefs/2026-10-foreman-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:foreman:foreman:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}