CVE-2026-12405 is a command injection vulnerability in rubygem-foreman_remote_execution used by Red Hat Satellite. The flaw occurs when the effective_user parameter in job templates marked as overridable is not properly sanitized during API requests to /api/v2/job_invocations. This allows an attacker with permissions to execute job templates to inject arbitrary shell commands, which are executed on the target infrastructure with the privileges of the execution user. The vulnerability does not depend on the job template content itself but on the instantiation process of the job execution environment by the Satellite server. Red Hat has issued a security advisory (RHSA-2026:74503) providing an official fix for Red Hat Satellite 6.19 on RHEL 9.

An attacker with permissions to execute job templates on Red Hat Satellite can exploit this vulnerability to execute arbitrary shell commands on target infrastructure with the privileges of the execution user. This can lead to full compromise of the affected systems, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update fixing this vulnerability in Red Hat Satellite 6.19 for RHEL 9. Users should apply the update provided in RHSA-2026:74503 as soon as possible. The vendor advisory is the authoritative source for remediation guidance. No additional mitigations are specified beyond applying the official patch.