Last updated: August 27, 2026 · Reading time: 7–8 minutes
A new major release, Foreman 5.0, is coming soon. Since the first release candidate now gives us a pretty clear idea of what’s in store, it’s time to take a look at it.
The Most Important Points at a Glance
- The version jump from 3.19 to 5.0 does not bring a flood of changes, but rather standardizes the versioning of Foreman and Katello.
- Foreman 5.0 supports Ruby 3.0 through 3.3; a switch to Rails 7.1 is in the works, but depends on EL 9 and Ubuntu 22.04.
- The new installation method
foremanctlrelies on Ansible and Podman-Quadlet instead of the traditional Puppet installer. - OpenVox is gradually replacing Puppet—Puppet will be completely removed starting with Foreman 5.2.
- Five CVEs have been fixed, four of which have already been backported to older versions.
Major version update to 5.0
The most striking thing is the jump from 3.19 to 5.0.
But no one here needs to worry that a flood of changes will come crashing down on them. Although the version change can also be justified by new features, its primary purpose is to standardize versioning between Foreman and Katello.
Katello started out as a standalone solution before being implemented in its current form as a plugin for Foreman. As a result, there have always been different versions, making it difficult to keep track of the corresponding mappings and know which ones go together. Since the teams—and thus the development process—have become increasingly integrated in recent years, the future, unified versioning system, which will be introduced with Foreman 5.0, is designed to reflect this.
Support for New Versions of Ruby
One problem that enterprise software often faces is the complex matrix of versions that need to be supported. This has long held back developers at Foreman. Because Enterprise Linux Version 8 required support for very old versions of Ruby. It wasn’t until support for the old operating system version was discontinued that development could move forward, and Ruby versions 3.0 through 3.3 are now supported.
This lays the groundwork for upgrading the Ruby on Rails version as well. However, moving to version 7.1 would mean dropping support for Ruby 3.0. Ubuntu 22.04 and EL 9 are currently still supported on this system.
The latter, in particular, is important to a large number of users, including many of our customers. For this reason, two options for future development are currently being evaluated. That would mean using Ruby 3.1 from a module instead of the default version 3.0, or migrating to EL 10 even when installing via the installer. The latter is not actually intended, since the goal is to switch to a container-based installation. More on this in the next section.
Overview of Supported Operating Systems
Bevor ich aber auf die Container-basierte Installation eingehe, will ich noch kurz darauf hinweisen, welche Versionen der verschiedenen Distributionen mit der kommenden Foreman-Version unterstützt werden.
As things stand now, support for EL 10 will be added in addition to EL 9, but only for the new installation method. Ubuntu 22.04 is still supported. The packages for 24.04 are not yet available, but they should be ready by the time of the final release. That will also be the time to upgrade, since support for 22.04 is scheduled to end with version 5.1. Although it can still be found in the manual on the official website, Debian 11 has not been supported for quite some time; only Debian 12 is now supported.
Support for Debian 13 may be added in the future; however, due to resource constraints, the priority is currently on the container-based installation and packaging for Ubuntu 24.04.
Container-based installation
Much of the development effort is currently focused on the new installation method using foremanctl. This is intended to replace the existing installer and bring Foreman into the world of containers. Currently, such an installation does not yet offer the same capabilities as before. But the difference is getting smaller practically every day, even though some features simply won’t be supported anymore in the future.
The new ` foremanctl ` command uses Ansible, rather than Puppet or OpenVox, as the previous installer did. This downloads, configures, and starts containers. Management is then handled by Podman-Quadlet, which creates systemd units for the containers. This makes it feel as if you’re still working with services that are natively installed on the system.
Currently, the project still relies on an installation from packages for the containers, which ensures that Foreman behaves the same way regardless of the installation method. Only once the change in the installation path has been fully completed should the intermediate step of packaging be omitted. Some of the containers are already using EL 10, and all of them are to be gradually migrated to it, which means that the x86_64_v3 hardware architecture will be required.
Questions about container-based installation?
We’re closely following the development of foremanctl and are here to advise you if you want to prepare your Foreman environment for it.
Get advice now →
What’s already working, and what isn’t yet
Currently, only the Katello scenario is supported on Enterprise Linux. However, a Foreman version without Katello and one that runs on Ubuntu are still in the works. Work is underway to support all features, although core functionalities such as software management with Katello and orchestration via Remote Execution are already operational.
The integration of managed services poses the greatest challenge in this regard and will likely be limited in the future to services that have a corresponding API. In addition, the option to have the installer install them as well will be removed. This means, for example, that a DHCP server must be installed and configured separately as needed.
OpenVox Instead of Puppet
One contribution from the Voxpopuli community is the migration from Puppet to OpenVox. Since Perforce effectively discontinued the open-source release of Puppet in early 2025, the use of Puppet is no longer recommended. Under OpenVox, the community is now maintaining a fork, which is already well supported by Foreman. A few minor issues remain unresolved and are expected to be resolved by Foreman 5.1 at the latest. Starting with version 5.2, support for Puppet will be completely removed, leaving only OpenVox supported.
Headline Feature
In addition to all the developments driving the project forward, we’ve also made significant progress on bug fixes and new features. As part of the containerization process, we switched from Redis to Valkey, which paves the way for further development in this area. Front-end development is simplified by support for TypeScript, and configuration is simplified by using a configuration directory.
Security has been enhanced by automatically blocking access attempts with invalid host headers and by both simplifying the Smart-Proxy’s TLS configuration and aligning it with the system policy on Enterprise Linux systems. However, both of these are breaking changes that must be taken into account.
Work was done on Katello’s container registry, and the first steps were taken to remove the “Dependency Solving” feature, as it often caused errors.
In addition, I think it’s worth highlighting that the modernization of the user interface—as part of the migration to Design Patternfly 5—is progressing well.
Closed CVEs
No software is flawless, so a few security vulnerabilities in Foreman need to be patched as well.
The following CVEs have already been backported to older versions and fixed there as well:
- CVE-2026-5138 allowed a user with permissions to edit a host to access another organization and retrieve information.
- CVE-2026-5135 went even further and allowed a user with permissions to edit a host to set or modify parameters on a host belonging to a third-party organization.
- CVE-2026-5142 allowed affected users to access a private key associated with a compute resource belonging to another organization.
- CVE-2026-5136 allowed a user with the permission to manage user groups to also modify those groups’ permissions, thereby even gaining administrator privileges.
The only new item is the following CVE, which has been fixed:
- CVE-2026-12515 allows a user with edit permissions for certain products to gain read access to repositories outside of those products.
Conclusion on Foreman 5.0
Even though the version number jumps to Foreman 5.0, it’s really just a routine update. However, a great deal of development is still underway here that is important for the future of the project. It’s definitely worth keeping an eye on the supported operating system versions and factoring them into your update strategy. It is also important to keep an eye on developments related to container-based installation.
But not only is the project evolving; it must also take into account developments within the ecosystem. While OpenVox may be the most obvious example, support for the KEA DHCP server is also planned for the future, and the “bootc ” installation method is expected to simplify provisioning.
As always, we’re happy to provide advice and support if you need help updating to the new version. But feel free to reach out to us about other topics related to Foreman, Katello, or Ansible as well!
