EUVD Vulnerability Catalog

EUVD-2026-90921

Severity: CRITICAL Base Score: 9.9 CVSS Version: 3.1

Vulnerability Description

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): Low

▪ User Interaction (UI): None

▪ Scope (S): Changed

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): High

Affected Vendors & Systems

Vendor Red Hat

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

redhat

EPSS Probability

Known Aliases

CVE-2026-96658

Published On

2026-10-01

Last Updated

2026-10-01