A critical command injection vulnerability in the Foreman WebSocket proxy enables remote code execution, potentially leading to a total compromise of the managed infrastructure.

This is an OS command injection vulnerability (CWE-78) occurring in the WebSocket proxy implementation. An attacker who controls a compute resource provider can supply a malicious hostname, which is then unsanitized and executed by the server when a user attempts to access the VM VNC console, requiring low privileges and user interaction.

The potential for remote code execution represents a critical threat to organizational security. Successful exploitation allows an attacker to gain full control over the Foreman server, enabling the theft of administrative credentials and unauthorized access to the entire managed infrastructure. Given the high CVSS score of 8.0, this vulnerability poses a severe risk to system integrity, confidentiality, and overall operational continuity.

Immediate Action: Update your Red Hat Satellite instances to the fixed versions listed in the referenced vendor errata (RHSA-2026:5968, RHSA-2026:5970, and RHSA-2026:5971).

Proactive Monitoring: Review system logs for suspicious shell commands or abnormal activity originating from the WebSocket proxy service.

Compensating Controls: Ensure that access to compute resource configuration and VNC console functionality is strictly limited to authorized administrators to minimize the attack surface.

Public Exploit Available: Unknown.

The risk posed by this command injection vulnerability is significant due to the potential for full server compromise. Administrators must prioritize applying the provided security updates immediately to eliminate the underlying flaw. Failure to patch these systems leaves the management infrastructure exposed to potential remote code execution attacks.