CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1)
Authenticated Foreman Remote Execution users can inject commands via effective_user; fixed in 16.6.6, 17.2.2, and 18.0.1.
Ondrej Gajdusek disclosed CVE-2026-12405 in Foreman Remote Execution, the open-source job plugin for Foreman. An authenticated user allowed to execute job templates can inject commands through the overridable effective_user parameter because input is handled unsafely. Fixes shipped in versions 16.6.6, 17.2.2, and 18.0.1. The post does not report observed exploitation.
- Authenticated users who can run job templates are affected.
- Commands can be injected via the overridable effective_user parameter.
- Fixed in Remote Execution 16.6.6, 17.2.2, and 18.0.1.
- No in-the-wild exploitation is reported.
Vulnerabilities mentionedAll →
- CVE-2026-124058.8—Command injection in Red Hat Satellite job invocationspublished · Red Hat Satellite (rubygem-foreman_remote_execution)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12405 | Command injection in Red Hat Satellite job invocations A command-injection flaw (CWE-78) in rubygem-foreman_remote_execution affects the Red Hat Satellite API at /api/v2/job_invocations. When a job template marks effective_user as overridable, the server does not properly sanitize the effective_user value from the API request; the injection occurs while Satellite instantiates the job execution environment, not inside the job template or playbook. An attacker who can already run job templates can inject arbitrary shell commands that execute on target systems with the privileges of the execution user, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, network, low privileges). Organizations running Red Hat Satellite or Foreman remote execution with overridable effective_user templates are affected. No public proof-of-concept is known and the issue is not in CISA KEV. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Foreman Remote Execution, an open-source plugin for Foreman, an open-source lifecycle management tool for physical and virtual servers. CVE-2026-12405: Foreman Remote Execution: command injection via effective_user An authenticated user with permission to execute job templates can inject commands through the overridable `effective_user` parameter during job invocation. Improper input handling allows...
This source does not provide full text. Read it at seclists.org.