CVE-2026-1961 (GCVE-0-2026-1961)

Vulnerability from cvelistv5 – Published: 2026-03-26 12:53 – Updated: 2026-03-27 16:18
VLAI?
Title
Forman: foreman: remote code execution via command injection in websocket proxy
Summary
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
Assigner
References
https://access.redhat.com/errata/RHSA-2026:5968 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5970 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:5971 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-1961 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2437036 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat Satellite 6.16 for RHEL 8 Unaffected: 0:3.12.0.14-1.el8sat , < * (rpm)
    cpe:/a:redhat:satellite:6.16::el8
    cpe:/a:redhat:satellite_utils:6.16::el8
    cpe:/a:redhat:satellite_capsule:6.16::el9
    cpe:/a:redhat:satellite_capsule:6.16::el8
    cpe:/a:redhat:satellite_utils:6.16::el9
    cpe:/a:redhat:satellite_maintenance:6.16::el9
    cpe:/a:redhat:satellite:6.16::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.16 for RHEL 9 Unaffected: 0:3.12.0.14-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite:6.16::el8
    cpe:/a:redhat:satellite_utils:6.16::el8
    cpe:/a:redhat:satellite_capsule:6.16::el9
    cpe:/a:redhat:satellite_capsule:6.16::el8
    cpe:/a:redhat:satellite_utils:6.16::el9
    cpe:/a:redhat:satellite_maintenance:6.16::el9
    cpe:/a:redhat:satellite:6.16::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.14.0.14-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.1.23-0.3.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.2.0-0.1.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.2.28-0.1.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:2.22.3-1.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.27.10-2.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.5.1-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.4.3-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.16.0.14-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.13.0-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:6.17.7-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.0.3-4.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.14.0.14-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.1.23-0.3.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.2.0-0.1.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.2.28-0.1.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:2.22.3-1.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:3.27.10-2.el9pc , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:1.5.1-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.4.3-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:4.16.0.14-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.13.0-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:6.17.7-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.17 for RHEL 9 Unaffected: 0:0.0.3-4.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_capsule:6.17::el9
    cpe:/a:redhat:satellite:6.17::el9
    cpe:/a:redhat:satellite_maintenance:6.17::el9
    cpe:/a:redhat:satellite_utils:6.17::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6.18 for RHEL 9 Unaffected: 0:3.16.0.12-1.el9sat , < * (rpm)
    cpe:/a:redhat:satellite_utils:6.18::el9
    cpe:/a:redhat:satellite:6.18::el9
    cpe:/a:redhat:satellite_capsule:6.18::el9
Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
Create a notification for this product.
Date Public ?
2026-03-26 12:30
Credits
Red Hat would like to thank Houssam Sahli for reporting this issue.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1961",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T13:11:15.689121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T13:11:42.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-27T16:18:13.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/27/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.16::el8",
            "cpe:/a:redhat:satellite_utils:6.16::el8",
            "cpe:/a:redhat:satellite_capsule:6.16::el9",
            "cpe:/a:redhat:satellite_capsule:6.16::el8",
            "cpe:/a:redhat:satellite_utils:6.16::el9",
            "cpe:/a:redhat:satellite_maintenance:6.16::el9",
            "cpe:/a:redhat:satellite:6.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.16 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.12.0.14-1.el8sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6.16::el8",
            "cpe:/a:redhat:satellite_utils:6.16::el8",
            "cpe:/a:redhat:satellite_capsule:6.16::el9",
            "cpe:/a:redhat:satellite_capsule:6.16::el8",
            "cpe:/a:redhat:satellite_utils:6.16::el9",
            "cpe:/a:redhat:satellite_maintenance:6.16::el9",
            "cpe:/a:redhat:satellite:6.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.16 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.12.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.14.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "libcomps",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.1.23-0.3.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-brotli",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.0-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-django",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.2.28-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-container",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.22.3-1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-rpm",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.27.10-2.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-fog-kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.1-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-foreman_kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.4.3-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-katello",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.16.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-rubyipmi",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.13.0-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.17.7-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil-worker-forwarder",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.0.3-4.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.14.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "libcomps",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.1.23-0.3.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-brotli",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.0-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-django",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.2.28-0.1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-container",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.22.3-1.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulp-rpm",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.27.10-2.el9pc",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-fog-kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.1-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-foreman_kubevirt",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.4.3-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-katello",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.16.0.14-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rubygem-rubyipmi",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.13.0-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.17.7-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_capsule:6.17::el9",
            "cpe:/a:redhat:satellite:6.17::el9",
            "cpe:/a:redhat:satellite_maintenance:6.17::el9",
            "cpe:/a:redhat:satellite_utils:6.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil-worker-forwarder",
          "product": "Red Hat Satellite 6.17 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.0.3-4.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite_utils:6.18::el9",
            "cpe:/a:redhat:satellite:6.18::el9",
            "cpe:/a:redhat:satellite_capsule:6.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman",
          "product": "Red Hat Satellite 6.18 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.16.0.12-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite-utils:el8/foreman",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Houssam Sahli for reporting this issue."
        }
      ],
      "datePublic": "2026-03-26T12:30:45.446Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman\u0027s WebSocket proxy implementation. This vulnerability arises from the system\u0027s use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T23:00:16.222Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:5968",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5968"
        },
        {
          "name": "RHSA-2026:5970",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5970"
        },
        {
          "name": "RHSA-2026:5971",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:5971"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1961"
        },
        {
          "name": "RHBZ#2437036",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437036"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-05T10:40:57.141Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-26T12:30:45.446Z",
          "value": "Made public."
        }
      ],
      "title": "Forman: foreman: remote code execution via command injection in websocket proxy",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-1961",
    "datePublished": "2026-03-26T12:53:09.566Z",
    "dateReserved": "2026-02-05T10:43:18.671Z",
    "dateUpdated": "2026-03-27T16:18:13.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-1961\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-03-26T13:16:27.650\",\"lastModified\":\"2026-03-27T17:16:27.193\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman\u0027s WebSocket proxy implementation. This vulnerability arises from the system\u0027s use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un fallo en Foreman. Un atacante remoto podr\u00eda explotar una vulnerabilidad de inyecci\u00f3n de comandos en la implementaci\u00f3n del proxy WebSocket de Foreman. Esta vulnerabilidad surge del uso por parte del sistema de valores de nombre de host no saneados de proveedores de recursos de c\u00f3mputo al construir comandos de shell. Al operar un servidor de recursos de c\u00f3mputo malicioso, un atacante podr\u00eda lograr la ejecuci\u00f3n remota de c\u00f3digo en el servidor de Foreman cuando un usuario accede a la funcionalidad de la consola VNC de una VM. Esto podr\u00eda llevar al compromiso de credenciales sensibles y de toda la infraestructura gestionada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5968\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5970\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5971\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-1961\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2437036\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/03/27/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/03/27/3\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-03-27T16:18:13.602Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-1961\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-26T13:11:15.689121Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-26T13:11:38.229Z\"}}], \"cna\": {\"title\": \"Forman: foreman: remote code execution via command injection in websocket proxy\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Houssam Sahli for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_utils:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\", \"cpe:/a:redhat:satellite_utils:6.16::el9\", \"cpe:/a:redhat:satellite_maintenance:6.16::el9\", \"cpe:/a:redhat:satellite:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.12.0.14-1.el8sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"foreman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_utils:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\", \"cpe:/a:redhat:satellite_utils:6.16::el9\", \"cpe:/a:redhat:satellite_maintenance:6.16::el9\", \"cpe:/a:redhat:satellite:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.12.0.14-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"foreman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.14.0.14-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"foreman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.1.23-0.3.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libcomps\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.2.0-0.1.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-brotli\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.2.28-0.1.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-django\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.22.3-1.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pulp-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.27.10-2.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pulp-rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-fog-kubevirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.4.3-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-foreman_kubevirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.16.0.14-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-katello\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.13.0-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-rubyipmi\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:6.17.7-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.0.3-4.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"yggdrasil-worker-forwarder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.14.0.14-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"foreman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.1.23-0.3.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libcomps\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.2.0-0.1.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-brotli\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.2.28-0.1.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-django\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.22.3-1.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pulp-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.27.10-2.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pulp-rpm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-fog-kubevirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.4.3-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-foreman_kubevirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.16.0.14-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-katello\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.13.0-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rubygem-rubyipmi\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:6.17.7-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_capsule:6.17::el9\", \"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_maintenance:6.17::el9\", \"cpe:/a:redhat:satellite_utils:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.0.3-4.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"yggdrasil-worker-forwarder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite_utils:6.18::el9\", \"cpe:/a:redhat:satellite:6.18::el9\", \"cpe:/a:redhat:satellite_capsule:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.16.0.12-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"foreman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite-utils:el8/foreman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-05T10:40:57.141Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-26T12:30:45.446Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-03-26T12:30:45.446Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:5968\", \"name\": \"RHSA-2026:5968\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5970\", \"name\": \"RHSA-2026:5970\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5971\", \"name\": \"RHSA-2026:5971\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-1961\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2437036\", \"name\": \"RHBZ#2437036\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman\u0027s WebSocket proxy implementation. This vulnerability arises from the system\u0027s use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-03-26T23:00:16.222Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-1961\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-27T16:18:13.602Z\", \"dateReserved\": \"2026-02-05T10:43:18.671Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-03-26T12:53:09.566Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…