{"api_version":"1","generated_at":"2026-04-22T23:30:57+00:00","cve":"CVE-2026-1961","urls":{"html":"https://cve.report/CVE-2026-1961","api":"https://cve.report/api/cve/CVE-2026-1961.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-1961","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1961"},"summary":{"title":"Forman: foreman: remote code execution via command injection in websocket proxy","description":"A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-03-26 13:16:27","updated_at":"2026-04-08 12:16:20"},"problem_types":["CWE-78","CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Secondary","score":"8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:5968","name":"https://access.redhat.com/errata/RHSA-2026:5968","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437036","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2437036","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-1961","name":"https://access.redhat.com/security/cve/CVE-2026-1961","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:5970","name":"https://access.redhat.com/errata/RHSA-2026:5970","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2026/03/27/3","name":"http://www.openwall.com/lists/oss-security/2026/03/27/3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:5971","name":"https://access.redhat.com/errata/RHSA-2026:5971","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1961","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1961","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","version":"unaffected 0:3.12.0.14-1.el8sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 9","version":"unaffected 0:3.12.0.14-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:3.14.0.14-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.1.23-0.3.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:1.2.0-0.1.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:4.2.28-0.1.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:2.22.3-1.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:3.27.10-2.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:1.5.1-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.4.3-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:4.16.0.14-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.13.0-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:6.17.7-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.0.3-4.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:3.14.0.14-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.1.23-0.3.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:1.2.0-0.1.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:4.2.28-0.1.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:2.22.3-1.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:3.27.10-2.el9pc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:1.5.1-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.4.3-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:4.16.0.14-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.13.0-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:6.17.7-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.17 for RHEL 9","version":"unaffected 0:0.0.3-4.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6.18 for RHEL 9","version":"unaffected 0:3.16.0.12-1.el9sat * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Satellite 6","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-02-05T10:40:57.141Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-03-26T12:30:45.446Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Houssam Sahli for reporting this issue.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-1961","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-26T13:11:15.689121Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-03-26T13:11:42.162Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-03-27T16:18:13.602Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/03/27/3"}],"title":"CVE Program Container"}],"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el9","cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_maintenance:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.14-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el9","cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_maintenance:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.14-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.14-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"libcomps","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.23-0.3.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-brotli","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.0-0.1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-django","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.2.28-0.1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-container","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.22.3-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.27.10-2.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-fog-kubevirt","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.1-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-foreman_kubevirt","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.4.3-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.16.0.14-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-rubyipmi","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.13.0-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"satellite","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.17.7-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"yggdrasil-worker-forwarder","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.0.3-4.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.14-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"libcomps","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.23-0.3.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-brotli","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.0-0.1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-django","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.2.28-0.1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-container","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.22.3-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.27.10-2.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-fog-kubevirt","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.1-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-foreman_kubevirt","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.4.3-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.16.0.14-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-rubyipmi","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.13.0-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"satellite","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.17.7-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9"],"defaultStatus":"affected","packageName":"yggdrasil-worker-forwarder","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.0.3-4.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.12-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"satellite-utils:el8/foreman","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"credits":[{"lang":"en","value":"Red Hat would like to thank Houssam Sahli for reporting this issue."}],"datePublic":"2026-03-26T12:30:45.446Z","descriptions":[{"lang":"en","value":"A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-08T11:23:19.413Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2026:5968","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:5968"},{"name":"RHSA-2026:5970","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:5970"},{"name":"RHSA-2026:5971","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:5971"},{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-1961"},{"name":"RHBZ#2437036","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437036"}],"timeline":[{"lang":"en","time":"2026-02-05T10:40:57.141Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-26T12:30:45.446Z","value":"Made public."}],"title":"Forman: foreman: remote code execution via command injection in websocket proxy","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-1961","datePublished":"2026-03-26T12:53:09.566Z","dateReserved":"2026-02-05T10:43:18.671Z","dateUpdated":"2026-04-08T11:23:19.413Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-03-26 13:16:27","lastModifiedDate":"2026-04-08 12:16:20","problem_types":["CWE-78","CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"1961","Ordinal":"1","Title":"Forman: foreman: remote code execution via command injection in ","CVE":"CVE-2026-1961","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"1961","Ordinal":"1","NoteData":"A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.","Type":"Description","Title":"Forman: foreman: remote code execution via command injection in "}]}}}