Command Injection in Red Hat Satellite (CVE-2026-12405)

CVE-2026-12405 is a command injection vulnerability affecting the rubygem-foreman_remote_execution component within Red Hat Satellite. The issue stems from insufficient input sanitization of the 'effective_user' parameter within the /api/v2/job_invocations endpoint. When a job template is configured with the 'effective_user' property set to 'overridable: true', an authenticated user with sufficient permissions to execute job templates can inject malicious shell commands. These commands are executed by the Satellite server during the instantiation of the job execution environment. Because the injection occurs at the API level rather than within the job template content itself, attackers can bypass intended restrictions, leading to arbitrary code execution on the infrastructure with the privileges of the defined execution user.

Impact

Successful exploitation allows an authenticated user to gain arbitrary command execution on Red Hat Satellite infrastructure. This vulnerability poses a high risk to environment integrity, as it grants attackers the ability to execute commands with the privileges of the targeted execution user, potentially leading to privilege escalation, lateral movement, or full compromise of the Satellite server and managed infrastructure.

Recommendation

1. Review all Job Templates in Red Hat Satellite and identify templates where the 'effective_user' property is set to 'overridable: true'.
2. Implement strict access controls for users with permissions to execute job templates to limit the exposure to this API endpoint.
3. Apply patches provided by Red Hat as soon as they become available to address the underlying sanitization flaw in rubygem-foreman_remote_execution.
4. Audit logs for anomalous POST requests to the /api/v2/job_invocations endpoint, specifically monitoring the 'effective_user' field for shell metacharacters or unexpected input patterns.