EUVD-2026-90914
GHSA-9jhx-3c73-g9rh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network API reachable (AV:N), low complexity once overridable is set (AC:L), requires an authenticated job-execution account (PR:L), no UI; injected commands yield full C/I/A on the execution host.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.
AnalysisAI
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman_remote_execution plugin, lets an authenticated Satellite user who holds job-template execution permissions run arbitrary shell commands on managed hosts. The injection only applies to job templates whose effective_user property is configured as overridable: true, in which case the user-supplied value is not sanitized before the Satellite server instantiates the job execution environment, so the payload executes during instantiation rather than through the template or playbook content itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete prerequisites: (1) an authenticated Satellite account possessing permission to execute job templates; (2) a target job template whose effective_user property is configured as overridable: true (a non-default, per-template setting) so the value can be supplied in the API call; and (3) the ability to reach the /api/v2/job_invocations API endpoint over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor erratum for this CVE, Red Hat Satellite RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), which is the authoritative fix path; the advisory references CVE-2026-12405 and Bugzilla 2488952 for the corresponding rubygem-foreman_remote_execution/Satellite updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Red Hat Satellite deployment and confirm the presence and version of the rubygem-foreman_remote_execution plugin, then audit all job templates for an effective_user property set to overridable: true and immediately switch those to overridable: false or remove the override capability, since this is the pre-condition the injection depends on; in parallel, review who holds job-template execution and remote-execution permissions and remove them from any account that does not strictly require them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only l
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit templ
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management perm
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today