A command injection vulnerability exists in Foreman's WebSocket proxy component used by Red Hat Satellite 6.16 for RHEL 8. The vulnerability arises from unsanitized hostname values from compute resource providers being used in shell command construction. An attacker operating a malicious compute resource server can exploit this flaw to achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. Red Hat has released security advisories RHSA-2026:5968 and RHSA-2026:5970 that include fixes for this issue in Red Hat Satellite versions 6.17 and 6.18. The CVSS v3.1 base score is 8.0, indicating high severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary commands on the Foreman server, potentially leading to full system compromise, exposure of sensitive credentials, and control over the managed infrastructure. The vulnerability affects Red Hat Satellite 6.16 for RHEL 8 and related versions prior to the patched releases. The CVSS score of 8.0 reflects a high impact on confidentiality, integrity, and availability.

Red Hat has released official security updates addressing CVE-2026-1961 in Red Hat Satellite versions 6.17 and 6.18. Users should apply these updates as detailed in the Red Hat advisories RHSA-2026:5968 and RHSA-2026:5970. Before applying these updates, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available in the official Red Hat Satellite documentation. No alternative mitigations or temporary fixes are indicated in the advisories.