Bug 2547645 (CVE-2026-107360)

Summary: CVE-2026-107360 rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, lblicha, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-07 20:08:58 UTC 
A flaw was found in rubygem-safemode. The parser allows op-assign AST nodes (op_asgn2, op_asgn_or, op_asgn_and, safe_op_asgn2, op_asgn1) without inserting .to_jail on the receiver, so compound assignment expressions such as x.foo ||= v, x.foo &&= v, x.foo += v, and x[k] += v execute getters, setters, and index operators directly on the real object. This completely bypasses the Jail method allow-list that is intended to mediate all method calls in sandboxed template code. An authenticated user who can influence Foreman/Satellite template content can invoke arbitrary no-argument methods on unjailed render-scope objects — including Host#destroy, which Host::Jail deliberately excludes — as well as disclose Jail-excluded getters and write through setters. Because the receiver is not jailed, other zero-argument ActiveRecord methods (for example attributes) are expected to be similarly reachable.

Reported via foreman-security / PSIRTSUPT-25192 (coordination) and PSIRTSUPT-25106 (initial forward). Credit: Kaya Emre Arikan (GitHub @kemrec). Confirmed by Foreman Security (Lukas Zapletal): a template-only user can call @host.destroy and delete the host record.