Junglewise Threat Intelligence

CVE-2026-1961: Foreman command injection in WebSocket proxy

CVE-2026-1961 · Severity: high · CVSS 8 · Published 2026-03-26

Technologies: Foreman. Vendors: Foreman, Red Hat.

Executive brief

Foreman, a tool used for managing physical and virtual servers, contains a security flaw in its WebSocket proxy component. An attacker who controls a malicious compute resource (such as a compromised virtual machine server) can execute unauthorized commands on the Foreman server when an administrator attempts to access a VM's console. This could allow the attacker to take full control of the management server, potentially compromising the entire managed infrastructure and sensitive credentials.

Technical details

A command injection vulnerability exists in Foreman's WebSocket proxy implementation due to improper neutralization of special elements used in OS commands (CWE-78). The vulnerability is triggered when the system uses unsanitized hostname values provided by compute resource providers to construct shell commands. An attacker can exploit this by operating a malicious compute resource server; when a user attempts to access the VNC console functionality for a VM on that resource, the malicious hostname triggers remote code execution on the Foreman server. The attack requires low privileges (PR:L) and user interaction (UI:R). Patches have been released for Foreman and integrated into Red Hat Satellite versions 6.16, 6.17, and 6.18.

Affected products

  • Foreman Foreman Before 3.12.0.14-1.el8sat
  • Red Hat Red Hat Satellite 6.16
  • Red Hat Red Hat Satellite 6.17
  • Red Hat Red Hat Satellite 6.18

Timeline

  • 2026-03-26: disclosed
  • 2026-03-26: advisory
  • 2026-03-26: patched

References

Related threats