# CVE-2026-1961: Foreman command injection in WebSocket proxy

Source: https://junglewise.ai/threats/cve-2026-1961-foreman-command-injection-in-websocket-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-1961 · Severity: high · CVSS 8 · Published 2026-03-26

Foreman, a tool used for managing physical and virtual servers, contains a security flaw in its WebSocket proxy component. An attacker who controls a malicious compute resource (such as a compromised virtual machine server) can execute unauthorized commands on the Foreman server when an administrator attempts to access a VM's console. This could allow the attacker to take full control of the management server, potentially compromising the entire managed infrastructure and sensitive credentials.

Technologies: [Foreman](https://junglewise.ai/threats/technologies/foreman). Vendors: [Foreman](https://junglewise.ai/threats/vendors/foreman).

## Quick answers

**Is CVE-2026-1961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1961 being exploited in the wild.

**How severe is CVE-2026-1961?** High severity, with a CVSS score of 8, published 26 March 2026.

**Which products and versions are affected?** Foreman Before 3.12.0.14-1.el8sat.

**Is there a fix for CVE-2026-1961?** A patch was published on 2026-03-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1961 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1961?** Check whether you run Foreman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in Foreman's WebSocket proxy implementation due to improper neutralization of special elements used in OS commands (CWE-78). The vulnerability is triggered when the system uses unsanitized hostname values provided by compute resource providers to construct shell commands. An attacker can exploit this by operating a malicious compute resource server; when a user attempts to access the VNC console functionality for a VM on that resource, the malicious hostname triggers remote code execution on the Foreman server. The attack requires low privileges (PR:L) and user interaction (UI:R). Patches have been released for Foreman and integrated into Red Hat Satellite versions 6.16, 6.17, and 6.18.

## Affected products

- Foreman Foreman Before 3.12.0.14-1.el8sat
- Red Hat Red Hat Satellite 6.16
- Red Hat Red Hat Satellite 6.17
- Red Hat Red Hat Satellite 6.18

## Timeline

- 2026-03-26: disclosed
- 2026-03-26: advisory
- 2026-03-26: patched

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:5968](https://access.redhat.com/errata/RHSA-2026:5968)
- [https://access.redhat.com/errata/RHSA-2026:5970](https://access.redhat.com/errata/RHSA-2026:5970)
- [https://access.redhat.com/errata/RHSA-2026:5971](https://access.redhat.com/errata/RHSA-2026:5971)
- [https://access.redhat.com/security/cve/CVE-2026-1961](https://access.redhat.com/security/cve/CVE-2026-1961)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2437036](https://bugzilla.redhat.com/show_bug.cgi?id=2437036)
- [http://www.openwall.com/lists/oss-security/2026/03/27/3](http://www.openwall.com/lists/oss-security/2026/03/27/3)

## Related threats

- [Foreman OS command injection in rake database tasks](https://junglewise.ai/threats/cve-2026-12541-a-flaw-was-found-in-foreman-os-command-injection-vulnerabilities)
- [Foreman information disclosure via improper validation in taxonomy_scope](https://junglewise.ai/threats/cve-2026-5138-foreman-information-disclosure-via-improper-validation-in-taxonomy)
- [Foreman broken access control in host lookup value overrides](https://junglewise.ai/threats/cve-2026-5135-foreman-broken-access-control-in-host-lookup-value-overrides)
- [Foreman privilege escalation in Usergroup model](https://junglewise.ai/threats/cve-2026-5136-foreman-privilege-escalation-in-usergroup-model)