EUVD-2026-16167
GHSA-fh2w-2c26-vpg5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
Articles & Coverage 1
AnalysisAI
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy implementation when users access VM VNC console functionality. An attacker controlling a malicious compute resource server can inject unsanitized hostname values into shell commands, compromising the Foreman server and potentially the entire managed infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated Foreman user with permission to access VM VNC console. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 8.0 (High severity) reflects the vulnerability's substantial impact with CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating network-accessible exploitation with low complexity but requiring low-privileged authentication and user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker establishes a malicious compute resource server (e.g., a rogue OpenStack or VMware endpoint) and configures it to return specially crafted hostname values containing shell metacharacters and command injection payloads. The attacker then socially engineers a Foreman administrator or convinces them through legitimate workflow to add this malicious compute resource to the Foreman instance or access VNC console functionality for a VM on this infrastructure. … |
| Remediation | Apply security patches provided by Red Hat for Satellite 6 as documented in the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-1961. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Red Hat Foreman and Satellite 6 instances, document versions, and identify which systems have external or untrusted compute resource server connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today