A command injection vulnerability exists in Red Hat Satellite 6.19 for RHEL 9 within the rubygem-foreman_remote_execution component. Specifically, the API endpoint /api/v2/job_invocations fails to properly sanitize the effective_user parameter when the job template's effective_user property is overridable. This allows an attacker with permissions to execute job templates to inject arbitrary shell commands that run on the target infrastructure with the execution user's privileges. The injection occurs during the instantiation of the job execution environment and does not depend on the job template or playbook content. Red Hat has issued an official security advisory (RHSA-2026:74503) that includes a patch to remediate this issue.

Successful exploitation allows an attacker with job template execution permissions to execute arbitrary shell commands on target systems with the privileges of the execution user. This can lead to full compromise of the affected infrastructure, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update addressing this vulnerability in Red Hat Satellite 6.19.5 for RHEL 9. Users should apply the update as soon as possible to remediate the command injection flaw. Detailed update instructions are available in the Red Hat advisory RHSA-2026:74503. No additional mitigations are required beyond applying the official patch.