CVSS 3.1
9.6 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NCVE-2026-107360 Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions
Critical (9.6) in red hat. EPSS 0.5% estimated probability of exploitation activity in the next 30 days.
On this page
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
Severity
- EPSS
- 0.5% estimated probability of exploitation activity in the next 30 days; 42nd percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CISA's assessment (SSVC)
- Exploitation: none · Automatable: no · Technical impact: total, assessed 2026-11-13. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
- CWE
- CWE-183 Permissive List of Allowed Inputs
- OWASP Top 10
- A06:2025 Insecure Design
- Published
- Modified
- Assigned by
- redhat (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-107360 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-107360?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-107360?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-107360 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-107360)
HTML:
<a href="https://cve.bz/cve/CVE-2026-107360"><img src="https://cve.bz/cve/badge/CVE-2026-107360.svg" alt="CVE-2026-107360"></a>
Affected
- red hat:red hat satellite 6.16 for rhel 8
- red hat:red hat satellite 6.16 for rhel 9
- red hat:red hat satellite 6.17 for rhel 9
- red hat:red hat satellite 6.18 for rhel 9
- red hat:red hat satellite 6.19 for rhel 9
Versions
From the CNA's record in the CVE List.
Fixed in
| Product | Fixed in |
|---|---|
| Red Hat Satellite 6.16 for RHEL 8 | 0:1.5.0-3.el8sat |
| Red Hat Satellite 6.16 for RHEL 9 | 0:1.5.0-3.el9sat |
| Red Hat Satellite 6.17 for RHEL 9 | 0:1.5.0-3.el9sat |
| Red Hat Satellite 6.18 for RHEL 9 | 0:1.5.0-3.el9sat |
| Red Hat Satellite 6.19 for RHEL 9 | 0:1.5.0-3.el9sat |
Fix and patched versions
- Red Hat Red Hat Satellite 6.16 for RHEL 8: fixed in 0:1.5.0-3.el8sat
- Red Hat Red Hat Satellite 6.16 for RHEL 9: fixed in 0:1.5.0-3.el9sat
- Red Hat Red Hat Satellite 6.17 for RHEL 9: fixed in 0:1.5.0-3.el9sat
- Red Hat Red Hat Satellite 6.18 for RHEL 9: fixed in 0:1.5.0-3.el9sat
- Red Hat Red Hat Satellite 6.19 for RHEL 9: fixed in 0:1.5.0-3.el9sat
- Red Hat: fixed package versions per release
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Red Hat | satellite:6.16::el8 | candlepin, candlepin-selinux | 0:4.4.26-2.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8 | foreman, foreman-cli, foreman-ec2 and 12 more | 0:3.12.0.26-1.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8 | rubygem-crass | 0:1.0.8-1.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8 | rubygem-katello | 0:4.14.0.24-1.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8 | rubygem-puma, rubygem-puma-debuginfo, rubygem-puma-debugsource | 0:6.4.3-2.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8 | rubygem-safemode | 0:1.5.0-3.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8, satellite_capsule:6.16::el8 | python-pulp-rpm, python3.11-pulp-rpm | 0:3.26.9-1.el8pc | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8, satellite_capsule:6.16::el8 | python-pulpcore, python3.11-pulpcore | 0:3.49.39-5.el8pc | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8, satellite_capsule:6.16::el8 | python-pyjwt, python3.11-pyjwt, python3.11-pyjwt+crypto | 0:2.15.1-1.el8pc | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8, satellite_capsule:6.16::el8 | python-pysequoia, python3.11-pysequoia | 0:0.1.35-1.el8pc | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el8, satellite_capsule:6.16::el8 | rubygem-smart_proxy_dynflow | 0:0.9.3-2.el8sat | RHSA-2026:99949 |
| Red Hat | satellite:6.16::el9 | candlepin, candlepin-selinux | 0:4.4.26-2.el9sat | RHSA-2026:99949 |
| 68 more for Red Hat in the JSON and on Red Hat's page. | ||||
From the distributions' data via OSV.dev: Red Hat Security Data © Red Hat, Inc., CC BY 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Red Hat.
Red Hat
Red Hat rates this Critical.
Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Satellite 6.16 for RHEL 8 | rubygem-safemode-0:1.5.0-3.el8sat | Fixed 2026-11-12 | RHSA-2026:99949 |
| Red Hat Satellite 6.16 for RHEL 9 | rubygem-safemode-0:1.5.0-3.el9sat | Fixed 2026-11-12 | RHSA-2026:99949 |
| Red Hat Satellite 6.17 for RHEL 9 | rubygem-safemode-0:1.5.0-3.el9sat | Fixed 2026-11-12 | RHSA-2026:99950 |
| Red Hat Satellite 6.18 for RHEL 9 | rubygem-safemode-0:1.5.0-3.el9sat | Fixed 2026-11-12 | RHSA-2026:99952 |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-107360.
GitHub PoC (unverified)
Repositories on GitHub named after this CVE. Nobody has checked them and they are not scanned: some hold a working proof of concept, some nothing useful, and some malware made to look like one. Read the code before you run any of it.
- googlesky/CVE-2026-107360 0 stars, Ruby, created
rubygem-safemode evaluates compound assignments in sandboxed Foreman/Satellite templates without Jail allow-list mediation: a template auth…
Attack patterns (CAPEC)
- CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
- CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
- CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
- CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.