{
  "threat_severity" : "Important",
  "public_date" : "2026-03-26T12:30:45Z",
  "bugzilla" : {
    "description" : "forman: Foreman: Remote Code Execution via command injection in WebSocket proxy",
    "id" : "2437036",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2437036"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "details" : [ "A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.", "A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure." ],
  "statement" : "This issue was rated as Important. Command injection vulnerability in Foreman's WebSocket proxy. Exploitation occurs when an administrator configures a malicious compute resource server and subsequently accesses its VM console functionality. Successful exploitation can lead to remote code execution on the Foreman server, potentially compromising sensitive credentials and the entire managed infrastructure.",
  "acknowledgement" : "Red Hat would like to thank Houssam Sahli for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Satellite 6.16 for RHEL 8",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5971",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.16::el8",
    "package" : "foreman-0:3.12.0.14-1.el8sat"
  }, {
    "product_name" : "Red Hat Satellite 6.16 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5971",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.16::el9",
    "package" : "foreman-0:3.12.0.14-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "foreman-0:3.14.0.14-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "libcomps-0:0.1.23-0.3.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "python-brotli-0:1.2.0-0.1.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "python-django-0:4.2.28-0.1.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "python-pulp-container-0:2.22.3-1.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "python-pulp-rpm-0:3.27.10-2.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "rubygem-fog-kubevirt-0:1.5.1-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "rubygem-foreman_kubevirt-0:0.4.3-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "rubygem-katello-0:4.16.0.14-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "rubygem-rubyipmi-0:0.13.0-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "satellite-0:6.17.7-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_maintenance:6.17::el9",
    "package" : "yggdrasil-worker-forwarder-0:0.0.3-4.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "foreman-0:3.14.0.14-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "libcomps-0:0.1.23-0.3.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "python-brotli-0:1.2.0-0.1.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "python-django-0:4.2.28-0.1.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "python-pulp-container-0:2.22.3-1.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "python-pulp-rpm-0:3.27.10-2.el9pc"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "rubygem-fog-kubevirt-0:1.5.1-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "rubygem-foreman_kubevirt-0:0.4.3-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "rubygem-katello-0:4.16.0.14-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "rubygem-rubyipmi-0:0.13.0-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "satellite-0:6.17.7-1.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.17 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5970",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.17::el9",
    "package" : "yggdrasil-worker-forwarder-0:0.0.3-4.el9sat"
  }, {
    "product_name" : "Red Hat Satellite 6.18 for RHEL 9",
    "release_date" : "2026-03-26T00:00:00Z",
    "advisory" : "RHSA-2026:5968",
    "cpe" : "cpe:/a:redhat:satellite_utils:6.18::el9",
    "package" : "foreman-0:3.16.0.12-1.el9sat"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Affected",
    "package_name" : "satellite-utils:el8/foreman",
    "cpe" : "cpe:/a:redhat:satellite:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-1961\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-1961" ],
  "name" : "CVE-2026-1961",
  "csaw" : false
}