kalnux/CVE-2026-1961-foreman-poc

PoC

PoC for CVE-2026-1961 — command injection in Foreman's WebSocket proxy (lib/ws_proxy.rb) via unsanitized compute resource hostname, leading to RCE as the foreman user. Responsibly disclosed and patched.

view exploit source poc_in_githubauthor kalnuxpublished 2026-09-17catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-1961UShigh8.8Exploit
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the syste…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan