EUVD-2026-16167
GHSA-fh2w-2c26-vpg5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
Articles & Coverage 1
AnalysisAI
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy implementation when users access VM VNC console functionality. An attacker controlling a malicious compute resource server can inject unsanitized hostname values into shell commands, compromising the Foreman server and potentially the entire managed infrastructure. A proof-of-concept exploit exists according to SSVC data, elevating real-world risk despite requiring low-privileged authentication and user interaction.
Technical ContextAI
This vulnerability affects Red Hat Foreman's WebSocket proxy component, specifically the VNC console access mechanism for virtual machines. The affected products are identified via CPE strings as cpe:2.3:a:red_hat:red_hat_satellite_6. The root cause is a command injection vulnerability where hostname values received from compute resource providers (hypervisors or cloud platforms) are not sanitized before being incorporated into shell commands executed by the Foreman server. When administrators or users access the VNC console of a virtual machine, the WebSocket proxy constructs commands using hostname data from the compute resource backend. If an attacker operates a malicious compute resource server that returns specially crafted hostname values, these malicious strings are passed directly to shell execution contexts, allowing arbitrary command execution with the privileges of the Foreman process.
RemediationAI
Apply security patches provided by Red Hat for Satellite 6 as documented in the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-1961. Consult the Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2437036 for specific patch versions and deployment guidance. Until patching is completed, implement defense-in-depth controls including restricting VNC console access to trusted administrators only, validating and auditing all compute resource configurations, implementing network segmentation to isolate Foreman servers from untrusted compute resource providers, and monitoring for unusual shell command execution patterns or unexpected compute resource additions. Organizations should prioritize patching in environments where users frequently access VNC consoles or where compute resource trust relationships cannot be fully verified.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Cleartext credential persistence in foreman-mcp-server, a component of Red Hat Satellite 6, exposes session identifiers
Server-Side Request Forgery (SSRF) in Foreman's HTTP proxy controller within Red Hat Satellite 6 allows high-privileged
Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding ho
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today