CVE-2026-1961 Forman: foreman: remote code execution via command injection in websocket proxy
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Red Hat
product: Red Hat Satellite 6.16 for RHEL 8
cpes: cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_maintenance:6.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.16 for RHEL 9
cpes: cpe:/a:redhat:satellite_utils:6.16::el8
cpe:/a:redhat:satellite:6.16::el9
cpe:/a:redhat:satellite_utils:6.16::el9
cpe:/a:redhat:satellite:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el8
cpe:/a:redhat:satellite_capsule:6.16::el9
cpe:/a:redhat:satellite_maintenance:6.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.17 for RHEL 9
cpes: cpe:/a:redhat:satellite:6.17::el9
cpe:/a:redhat:satellite_utils:6.17::el9
cpe:/a:redhat:satellite_capsule:6.17::el9
cpe:/a:redhat:satellite_maintenance:6.17::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6.18 for RHEL 9
cpes: cpe:/a:redhat:satellite_capsule:6.18::el9
cpe:/a:redhat:satellite:6.18::el9
cpe:/a:redhat:satellite_utils:6.18::el9
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Houssam Sahli for reporting this issue.
Published: 2026-03-26T12:53:09.566Z