IT SBIT Services
Schneeberger
DEEN
CVE tracker

Red Hat Satellite: Command injection in job invocations via effective_user

CVE-2026-12405High 8.8

← All vulnerabilities

Summary

The rubygem-foreman_remote_execution component of Red Hat Satellite contains a command injection flaw in the /api/v2/job_invocations API. If a job template has the effective_user property marked as overridable, the effective_user value supplied in an API request is not properly sanitized. An authenticated user who is allowed to execute job templates can run arbitrary shell commands with the privileges of the execution user on the target hosts.

Affected

  • Red Hat Satellite 6.16 for RHEL 8 and RHEL 9 (before 0:13.2.8-2.el8sat / 0:13.2.8-2.el9sat)
  • Red Hat Satellite 6.17 for RHEL 9 (before 0:15.0.2-2.el9sat)
  • Red Hat Satellite 6.18 for RHEL 9 (before 0:16.2.3-2.el9sat)
  • Red Hat Satellite 6.19 for RHEL 9 (before 0:16.5.3-2.el9sat)
  • Upstream Foreman Remote Execution 0.1.2 to 16.6.5, 16.7.0, 17.0.0 to 17.2.1 and 18.0.0
  • Older Satellite releases: Unknown.

Fixed in

  • Satellite 6.19.5 async update (RHSA-2026:74503)
  • Satellite 6.18.10 async update (RHSA-2026:74504)
  • Satellite 6.17.12 (RHSA-2026:74505)
  • Satellite 6.16.14 (RHSA-2026:74506)
  • Upstream: Foreman Remote Execution 18.0.1, 17.2.2 and 16.6.6

Workaround

  • Red Hat has not identified a practical workaround. Patching is the fix.
  • Restrict job template execution rights to trusted users only.
  • Review job templates where effective_user is overridable.

Exploitation

  • Known exploited: no evidence at time of analysis.
  • Public proof-of-concept exploit: none found.
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • Red Hat rates the issue Important; some mirrors label the errata critical.

Our recommendation

  • Patch Satellite to the fixed version for your release in a maintenance window.
  • Note that RHSA-2026:74506 also contains a provisioning-token fix (CVE-2026-12423); plan Bootdisk and token settings accordingly.
  • Audit who holds job execution rights and review job templates with overridable effective_user.
  • Review job invocation logs for unusual effective_user values.
  • Satellite should not be internet-facing; verify this.
  • Priority: medium if Satellite or Foreman is in use, low otherwise.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:57.

Original description (NVD)

A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed