CVE-2026-1961: Foreman command injection in WebSocket proxy

CVE-2026-1961 · Severity: high · CVSS 8 · Published 2026-03-26

Foreman, a tool used for managing physical and virtual servers, contains a security flaw in its WebSocket proxy component. An attacker who controls a malicious compute resource (such as a compromised virtual machine server) can execute unauthorized commands on the Foreman server when an administrator attempts to access a VM's console. This could allow the attacker to take full control of the management server, potentially compromising the entire managed infrastructure and sensitive credentials.

Technologies: Foreman. Vendors: Foreman.

Quick answers

Is CVE-2026-1961 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1961 being exploited in the wild.
How severe is CVE-2026-1961?
High severity, with a CVSS score of 8, published 26 March 2026.
Which products and versions are affected?
Foreman Before 3.12.0.14-1.el8sat.
Is there a fix for CVE-2026-1961?
A patch was published on 2026-03-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1961 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1961?
Check whether you run Foreman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in Foreman's WebSocket proxy implementation due to improper neutralization of special elements used in OS commands (CWE-78). The vulnerability is triggered when the system uses unsanitized hostname values provided by compute resource providers to construct shell commands. An attacker can exploit this by operating a malicious compute resource server; when a user attempts to access the VNC console functionality for a VM on that resource, the malicious hostname triggers remote code execution on the Foreman server. The attack requires low privileges (PR:L) and user interaction (UI:R). Patches have been released for Foreman and integrated into Red Hat Satellite versions 6.16, 6.17, and 6.18.

Affected products

  • Foreman Foreman Before 3.12.0.14-1.el8sat
  • Red Hat Red Hat Satellite 6.16
  • Red Hat Red Hat Satellite 6.17
  • Red Hat Red Hat Satellite 6.18

Timeline

  • 2026-03-26: disclosed
  • 2026-03-26: advisory
  • 2026-03-26: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.