CVE-2026-1961: redhat satellite OS Command Injection

Vulnerability summary

CVE-2026-1961 is a high (CVSS 8.8) OS Command Injection vulnerability in redhat satellite. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-03-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.