# CVE-2026-12405: Red Hat Satellite command injection in job invocations via effective_user

Source: https://junglewise.ai/threats/cve-2026-12405-a-flaw-was-found-in-rubygem-foreman-remote-execution-a-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-12405 · Severity: high · CVSS 8.8 · Published 2026-10-01

Red Hat Satellite is a systems management platform that automates provisioning and configuration of enterprise infrastructure. A command injection vulnerability in its job execution API allows authenticated attackers with job template execution privileges to inject arbitrary shell commands via the effective_user parameter, leading to command execution on target systems with the privileges of the execution user. This could result in complete infrastructure compromise including data theft, system takeover, and lateral movement.

Technologies: [Red Hat Satellite](https://junglewise.ai/threats/technologies/red-hat-satellite). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-12405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12405 being exploited in the wild.

**How severe is CVE-2026-12405?** High severity, with a CVSS score of 8.8, published 1 October 2026.

**Which products and versions are affected?** Red Hat Satellite 6.19 and earlier.

**Is there a fix for CVE-2026-12405?** Yes: fixed in Red Hat Satellite 6.19.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12405 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12405?** Check whether you run Red Hat Satellite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Red Hat Satellite 6.19.5

## Technical details

A command injection flaw exists in rubygem-foreman_remote_execution within Red Hat Satellite's /api/v2/job_invocations endpoint. When a job template has the effective_user property marked as overridable: true, the API fails to properly sanitize the effective_user input, allowing authenticated users to inject shell metacharacters. The vulnerability is triggered during job execution instantiation on the Satellite server, not during template evaluation, and executes injected commands with the privileges of the specified execution user.

## Affected products

- Red Hat Satellite 6.19 and earlier

## Timeline

- 2026-10-01: disclosed
- 2026-10-01: advisory

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:74503](https://access.redhat.com/errata/RHSA-2026:74503)

## Related threats

- [Red Hat Satellite Katello Flatpak API authorization bypass](https://junglewise.ai/threats/cve-2026-107445-a-flaw-was-found-in-katello-where-the-flatpak-remote)
- [Katello Docker Tags API organization scope bypass](https://junglewise.ai/threats/cve-2026-107444-a-flaw-was-found-in-katello-where-the-docker-tags-repositories)
- [Red Hat Satellite Katello SQL injection in Registry Proxy](https://junglewise.ai/threats/cve-2026-56097-a-flaw-was-found-in-rubygem-katello-an-sql-injection)