{"id":36340,"date":"2026-10-14T13:13:57","date_gmt":"2026-10-14T11:13:57","guid":{"rendered":"https:\/\/orcharhino.com\/ressourcen\/blog\/ressourcen\/release-notes\/orcharhino-7-10-cve-fix\/"},"modified":"2026-10-14T16:27:43","modified_gmt":"2026-10-14T14:27:43","slug":"security-fix-2026-10-14","status":"publish","type":"release_note","link":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/","title":{"rendered":"Security-release for version 7.10, 7.9, 7.8"},"content":{"rendered":"\n

orcharhino was affected by several CVEs. Those allowed authenticated users to get information about systems without the proper permissions or the ability to inject code-executions in certain processes.<\/p>\n\n\n\n

This fix contains patches for the affected packages. orcharhino administrators should update their instances to make sure, that those issues cannot be exploited.<\/p>\n\n\n\n

The fixes are included in the orcharhino-repositories for the versions: 7.8, 7.9, 7.10 (and the upcoming 7.11)<\/p>\n\n\n\n

For the update\/installation please follow the updating procedure as described in the documentation: Updating orcharhino – orcharhino documentation<\/a><\/p>\n\n\n\n

Changelog CVE<\/h2>\n\n\n\n
Fixed CVEs<\/strong><\/td>CVSS-Score (v3)<\/strong><\/td><\/tr>
CVE-2026-96658: An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine.<\/td>9.9<\/td><\/tr>
CVE-2026-96659: This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints.<\/td>9.1<\/td><\/tr>
CVE-2026-12405: When a job template has the effective_user property marked as overridable, the application fails to properly sanitize the effective_user input provided during the API request.<\/td>8.8<\/td><\/tr>
CVE-2026-54284: An attacker with ability to supply input to sqlparse before 0.6.0 can trigger CPU DoS.<\/td>8.7<\/td><\/tr>
CVE-2026-12540: In the ‘foreman-rake errors:fetch_log task’, the ‘request_id’ parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.<\/td>8.2<\/td><\/tr>
CVE-2026-12541: In the ‘foreman-rake db:dump’ and ‘db:import_dump’ tasks, the application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution.<\/td>8.2<\/td><\/tr>
CVE-2026-90959: An authenticated user with low-privilege repository permissions could supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process.<\/td>8.1<\/td><\/tr>
CVE-2026-12544: The foreman-rake initialization logic in ‘\/usr\/share\/foreman\/config\/settings.rb’ contains a vulnerable code pattern where configuration data is processed through two distinct executable layers.<\/td>7.7<\/td><\/tr>
CVE-2026-33154: dynaconf prior to 3.2.13 is affected by remote code execution via insecure template evaluation.<\/td>7.5<\/td><\/tr>
CVE-2026-78679: GitPython before 3.1.59 contains an arbitrary file read vulnerability<\/td>7.1<\/td><\/tr>
CVE-2026-12542: The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the ‘eval’ command.<\/td>5.3<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

orcharhino was affected by several CVEs. Those allowed authenticated users to get information about systems without the proper permissions or the ability to inject code-executions in certain processes. This fix contains patches for the affected packages. orcharhino administrators should update their instances to make sure, that those issues cannot be exploited. The fixes are included […]<\/p>\n","protected":false},"author":261,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","_links_to":"","_links_to_target":""},"branche":[],"use-case-kategorie":[],"class_list":["post-36340","release_note","type-release_note","status-publish","format-standard","hentry"],"acf":[],"yoast_head":"\nSecurity-release for version 7.10, 7.9, 7.8 | orcharhino<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security-release for version 7.10, 7.9, 7.8\" \/>\n<meta property=\"og:description\" content=\"orcharhino was affected by several CVEs. Those allowed authenticated users to get information about systems without the proper permissions or the ability to inject code-executions in certain processes. This fix contains patches for the affected packages. orcharhino administrators should update their instances to make sure, that those issues cannot be exploited. The fixes are included […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/\" \/>\n<meta property=\"og:site_name\" content=\"orcharhino\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ATIXDE\/\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-14T14:27:43+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@orcharhino\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/release-notes\\\/security-fix-2026-10-14\\\/\",\"url\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/release-notes\\\/security-fix-2026-10-14\\\/\",\"name\":\"Security-release for version 7.10, 7.9, 7.8 | orcharhino\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#website\"},\"datePublished\":\"2026-10-14T11:13:57+00:00\",\"dateModified\":\"2026-10-14T14:27:43+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/release-notes\\\/security-fix-2026-10-14\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/release-notes\\\/security-fix-2026-10-14\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/release-notes\\\/security-fix-2026-10-14\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"orcharhino\",\"item\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/startseite-neu\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security-release for version 7.10, 7.9, 7.8\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/\",\"name\":\"orcharhino\",\"description\":\"one tool to rule them all\",\"publisher\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#organization\",\"name\":\"orcharhino\",\"url\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/orcharhino.com\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/orcharhino_mask.svg\",\"contentUrl\":\"https:\\\/\\\/orcharhino.com\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/orcharhino_mask.svg\",\"width\":508,\"height\":508,\"caption\":\"orcharhino\"},\"image\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/ATIXDE\\\/\",\"https:\\\/\\\/x.com\\\/orcharhino\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/atix-ag\\\/\"],\"description\":\"orcharhino erm\u00f6glicht das automatisierte Deployment \u00fcber alle Betriebssysteme hinweg und die anschlie\u00dfende Verwaltung der Systeme mit Release- und Patch Management. Die Infrastruktur l\u00e4sst sich dabei eng entlang der eigenen Bed\u00fcrfnisse ausrichten. IT-Organisationen profitieren insbesondere von der Technologie- und Herstellerunabh\u00e4ngigkeit sowie von st\u00e4ndig aktualisierten Sicherheitsupdates. orcharhino ist als Open-Source-L\u00f6sung f\u00fcr Unternehmen besonders flexibel und unbegrenzt skalierbar, unabh\u00e4ngig von der Gr\u00f6\u00dfe der Infrastruktur oder der Anzahl der Devices \u2013 egal ob lokal oder global, in der Cloud oder On-Premises.\",\"email\":\"info@atix.de\",\"telephone\":\"+49 89 4523538-0\",\"legalName\":\"ATIX Informationstechnologie und Consulting AG\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Security-release for version 7.10, 7.9, 7.8 | orcharhino","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/","og_locale":"en_US","og_type":"article","og_title":"Security-release for version 7.10, 7.9, 7.8","og_description":"orcharhino was affected by several CVEs. Those allowed authenticated users to get information about systems without the proper permissions or the ability to inject code-executions in certain processes. This fix contains patches for the affected packages. orcharhino administrators should update their instances to make sure, that those issues cannot be exploited. The fixes are included […]","og_url":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/","og_site_name":"orcharhino","article_publisher":"https:\/\/www.facebook.com\/ATIXDE\/","article_modified_time":"2026-10-14T14:27:43+00:00","twitter_card":"summary_large_image","twitter_site":"@orcharhino","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/","url":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/","name":"Security-release for version 7.10, 7.9, 7.8 | orcharhino","isPartOf":{"@id":"https:\/\/orcharhino.com\/en\/#website"},"datePublished":"2026-10-14T11:13:57+00:00","dateModified":"2026-10-14T14:27:43+00:00","breadcrumb":{"@id":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/orcharhino.com\/en\/resources\/release-notes\/security-fix-2026-10-14\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"orcharhino","item":"https:\/\/orcharhino.com\/en\/startseite-neu\/"},{"@type":"ListItem","position":2,"name":"Security-release for version 7.10, 7.9, 7.8"}]},{"@type":"WebSite","@id":"https:\/\/orcharhino.com\/en\/#website","url":"https:\/\/orcharhino.com\/en\/","name":"orcharhino","description":"one tool to rule them all","publisher":{"@id":"https:\/\/orcharhino.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/orcharhino.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/orcharhino.com\/en\/#organization","name":"orcharhino","url":"https:\/\/orcharhino.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/orcharhino.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/orcharhino.com\/wp-content\/uploads\/2024\/12\/orcharhino_mask.svg","contentUrl":"https:\/\/orcharhino.com\/wp-content\/uploads\/2024\/12\/orcharhino_mask.svg","width":508,"height":508,"caption":"orcharhino"},"image":{"@id":"https:\/\/orcharhino.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/ATIXDE\/","https:\/\/x.com\/orcharhino","https:\/\/www.linkedin.com\/company\/atix-ag\/"],"description":"orcharhino erm\u00f6glicht das automatisierte Deployment \u00fcber alle Betriebssysteme hinweg und die anschlie\u00dfende Verwaltung der Systeme mit Release- und Patch Management. Die Infrastruktur l\u00e4sst sich dabei eng entlang der eigenen Bed\u00fcrfnisse ausrichten. IT-Organisationen profitieren insbesondere von der Technologie- und Herstellerunabh\u00e4ngigkeit sowie von st\u00e4ndig aktualisierten Sicherheitsupdates. orcharhino ist als Open-Source-L\u00f6sung f\u00fcr Unternehmen besonders flexibel und unbegrenzt skalierbar, unabh\u00e4ngig von der Gr\u00f6\u00dfe der Infrastruktur oder der Anzahl der Devices \u2013 egal ob lokal oder global, in der Cloud oder On-Premises.","email":"info@atix.de","telephone":"+49 89 4523538-0","legalName":"ATIX Informationstechnologie und Consulting AG"}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/release_note\/36340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/release_note"}],"about":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/types\/release_note"}],"author":[{"embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/users\/261"}],"replies":[{"embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/comments?post=36340"}],"version-history":[{"count":4,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/release_note\/36340\/revisions"}],"predecessor-version":[{"id":36360,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/release_note\/36340\/revisions\/36360"}],"wp:attachment":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/media?parent=36340"}],"wp:term":[{"taxonomy":"branche","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/branche?post=36340"},{"taxonomy":"use-case-kategorie","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/use-case-kategorie?post=36340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}