The vulnerability CVE-2026-1961 affects Red Hat Satellite's Foreman component, specifically its WebSocket proxy implementation. It is caused by improper neutralization of special elements in OS commands (CWE-78), where unsanitized hostname values from compute resource providers are incorporated into shell commands. An attacker operating a malicious compute resource server can exploit this flaw to achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This can lead to full compromise of the managed infrastructure and exposure of sensitive credentials. Red Hat has released security updates for Red Hat Satellite 6.17.7 and 6.18.4 that fix this vulnerability. The CVSS v3.1 base score is 8.0, indicating high severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows remote code execution on the Foreman server, potentially compromising sensitive credentials and the entire managed infrastructure. The vulnerability affects the confidentiality, integrity, and availability of the system, posing a high security risk.

Red Hat has released official security updates that fix this vulnerability in Red Hat Satellite versions 6.17.7 and 6.18.4. Users should apply these updates promptly. Before updating, ensure all previously released errata relevant to the system are applied. Detailed update instructions are available in the Red Hat Satellite documentation. No alternative mitigations or workarounds are specified in the vendor advisories.