Executive brief
Foreman, a tool used for managing physical and virtual servers, contains a security flaw in its WebSocket proxy component. An attacker who controls a malicious compute resource (such as a compromised virtual machine server) can execute unauthorized commands on the Foreman server when an administrator attempts to access a VM's console. This could allow the attacker to take full control of the management server, potentially compromising the entire managed infrastructure and sensitive credentials.
Technical details
A command injection vulnerability exists in Foreman's WebSocket proxy implementation due to improper neutralization of special elements used in OS commands (CWE-78). The vulnerability is triggered when the system uses unsanitized hostname values provided by compute resource providers to construct shell commands. An attacker can exploit this by operating a malicious compute resource server; when a user attempts to access the VNC console functionality for a VM on that resource, the malicious hostname triggers remote code execution on the Foreman server. The attack requires low privileges (PR:L) and user interaction (UI:R). Patches have been released for Foreman and integrated into Red Hat Satellite versions 6.16, 6.17, and 6.18.
Affected products
- Foreman Foreman Before 3.12.0.14-1.el8sat
- Red Hat Red Hat Satellite 6.16
- Red Hat Red Hat Satellite 6.17
- Red Hat Red Hat Satellite 6.18
Timeline
- 2026-03-26: disclosed
- 2026-03-26: advisory
- 2026-03-26: patched
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/errata/RHSA-2026:5968
- https://access.redhat.com/errata/RHSA-2026:5970
- https://access.redhat.com/errata/RHSA-2026:5971
- https://access.redhat.com/security/cve/CVE-2026-1961
- https://bugzilla.redhat.com/show_bug.cgi?id=2437036
- http://www.openwall.com/lists/oss-security/2026/03/27/3