CVE-2026-1961: Forman: foreman: remote code execution via command injection in websocket proxy

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• redhat satellite6.17 and later · before 6.17.7
• redhat satellite6.18 and later · before 6.18.4
• redhat satellite6.16 and later · before 6.16.7
• redhat satellite6.0
• theforeman foreman3.17.0 and later · before 3.17.2
• theforeman foremanbefore 3.16.3
• theforeman foreman3.18.0 and later · before 3.18.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Satellite 6

  • all versionsaffected

• Red Hat Red Hat Satellite 6.16 for RHEL 8

  • 0:3.12.0.14-1.el8sat and laternot affected · rpm

• Red Hat Red Hat Satellite 6.16 for RHEL 9

  • 0:3.12.0.14-1.el9sat and laternot affected · rpm

• Red Hat Red Hat Satellite 6.17 for RHEL 9

  • 0:3.14.0.14-1.el9sat and laternot affected · rpm
  • 0:0.1.23-0.3.el9pc and laternot affected · rpm
  • 0:1.2.0-0.1.el9pc and laternot affected · rpm
  • 0:4.2.28-0.1.el9pc and laternot affected · rpm
  • 0:2.22.3-1.el9pc and laternot affected · rpm
  • 0:3.27.10-2.el9pc and laternot affected · rpm
  • 0:1.5.1-1.el9sat and laternot affected · rpm
  • 0:0.4.3-1.el9sat and laternot affected · rpm
  • 0:4.16.0.14-1.el9sat and laternot affected · rpm
  • 0:0.13.0-1.el9sat and laternot affected · rpm

• Red Hat Red Hat Satellite 6.18 for RHEL 9

  • 0:3.16.0.12-1.el9sat and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-10137A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens.
  40Plan
• CVE-2024-7923Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
  39Monitor
• CVE-2024-7012Puppet-foreman: an authentication bypass vulnerability exists in foreman
  39Monitor

Published before and after this one in the same product

• ← EarlierCVE-2024-3716Jun 5, 2024 · Foreman-installer: candlepin database password being leaked to local users via the process list
  24Monitor
• ← EarlierCVE-2026-0980Feb 27, 2026 · Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username
  35Monitor
• Later →CVE-2026-9073Jun 23, 2026 · Foreman-mcp-server: mcp server: insecure sensitive http header sanitization
  24Monitor

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.