CVE-2026-1961highCWE-78

CVE-2026-1961: falha de alta gravidade em Red Hat Satellite 6

Forman: foreman: remote code execution via command injection in websocket proxy

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Satellite

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 1.9%
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat Satellite 6Red Hat · Red Hat Satellite 6.16 for RHEL 8Red Hat · Red Hat Satellite 6.16 for RHEL 9Red Hat · Red Hat Satellite 6.17 for RHEL 9Red Hat · Red Hat Satellite 6.18 for RHEL 9
CVEs relacionadas — Red Hat Satellite 6

No mesmo produto, das mais perigosas para as menos.

CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2022-3874HIGHOs command injection via ct_command and fcct_commandEPSS 2.2%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%CVE-2026-12541HIGHForeman: command injection in foreman-rake database tasksEPSS 1.2%CVE-2026-12540HIGHForeman: command injection in foreman-rake errors:fetch_log via request_id parameterEPSS 1.2%