High · published March 26, 2026
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
| Product | Versions | Fixed in |
|---|---|---|
| redhat/satellite | ≥ 6.16, < 6.16.7 | 6.16.7 |
| redhat/satellite | ≥ 6.17, < 6.17.7 | 6.17.7 |
| theforeman/foreman | < 3.16.3 | 3.16.3 |
| theforeman/foreman | ≥ 3.17.0, < 3.17.2 | 3.17.2 |
| theforeman/foreman | ≥ 3.18.0, < 3.18.1 | 3.18.1 |
| redhat/satellite | ≥ 6.18, < 6.18.4 | 6.18.4 |
| redhat/satellite | all versions | — |