Command Injection Vulnerability in Red Hat Satellite API Affecting Foreman Remote Execution
CVE-2026-12405

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6.19 For Rhel 9
Red Hat Satellite 6
Vendor
CVE Published:
1 October 2026

What is CVE-2026-12405?

A command injection vulnerability has been discovered in the Red Hat Satellite API related to the Foreman Remote Execution gem. This flaw exists when the effective_user property is set to overridable: true within job templates. The underlying issue is rooted in the API's failure to properly sanitize the effective_user input during job execution instantiation. Attackers with permissions to run job templates can exploit this vulnerability by injecting arbitrary shell commands that will execute on the target infrastructure with the permissions of the execution user. This poses a significant security risk, enabling potential unauthorized access and manipulation of system resources.

Affected Version(s)

Red Hat Satellite 6.19 for RHEL 9 0:16.5.3-2.el9sat

References

https://access.redhat.com/errata/RHSA-2026:74503
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-12405
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2488952
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Laura Pardo (Red Hat) and Toni Gornals (Red Hat).
.