Foreman Remote Execution security update: CVE-2026-12405

Release Announcements
1

Foreman Remote Execution plugin releases 18.0.1, 17.2.2, and 16.6.6 fix CVE-2026-12405, a command injection vulnerability involving the effective_user parameter during job invocation.

For RPM installations, fixed plugin packages are already available through the regular Foreman plugin repositories:

  • Foreman 5.0: rubygem-foreman_remote_execution-17.2.2
  • Foreman 3.19: rubygem-foreman_remote_execution-16.6.6

Users should follow the normal Foreman upgrade procedure to update their installed packages. For example:

dnf clean metadata
dnf upgrade 'ruby*' 'foreman*'

Full details: CVE-2026-12405

1 Like