Skip to content
fr Sign in
8.0 High

CVE-2026-1961 A flaw was found in Foreman

Description

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.

Affected products and versions

Product Affected versions Fixed in
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Satellite 6.16 for RHEL 8

The 49 CVEs of Red Hat Satellite 6.16 for RHEL 8 →
CVE-2026-56098 A flaw was found in rubygem-katello 4.3 Medium CVE-2026-56097 A flaw was found in rubygem-katello 6.5 Medium CVE-2026-12545 A flaw was found in rubygem-hammer_cli 6.7 Medium CVE-2026-12542 A flaw was found in Foreman 5.3 Medium
Track this CVE