{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-12423/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:red_hat:satellite:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-12405"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Satellite","Foreman"],"_cs_severities":["high"],"_cs_tags":["vulnerability","command-injection","server-side","web-application-vulnerability","authentication-bypass","cve-2026-12423"],"_cs_type":"advisory","_cs_vendors":["Red Hat","Foreman"],"content_html":"\u003cp\u003eCVE-2026-12405 is a command injection vulnerability affecting the rubygem-foreman_remote_execution component within Red Hat Satellite. The issue stems from insufficient input sanitization of the 'effective_user' parameter within the /api/v2/job_invocations endpoint. When a job template is configured with the 'effective_user' property set to 'overridable: true', an authenticated user with sufficient permissions to execute job templates can inject malicious shell commands. These commands are executed by the Satellite server during the instantiation of the job execution environment. Because the injection occurs at the API level rather than within the job template content itself, attackers can bypass intended restrictions, leading to arbitrary code execution on the infrastructure with the privileges of the defined execution user.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to gain arbitrary command execution on Red Hat Satellite infrastructure. This vulnerability poses a high risk to environment integrity, as it grants attackers the ability to execute commands with the privileges of the targeted execution user, potentially leading to privilege escalation, lateral movement, or full compromise of the Satellite server and managed infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview all Job Templates in Red Hat Satellite and identify templates where the 'effective_user' property is set to 'overridable: true'.\u003c/li\u003e\n\u003cli\u003eImplement strict access controls for users with permissions to execute job templates to limit the exposure to this API endpoint.\u003c/li\u003e\n\u003cli\u003eApply patches provided by Red Hat as soon as they become available to address the underlying sanitization flaw in rubygem-foreman_remote_execution.\u003c/li\u003e\n\u003cli\u003eAudit logs for anomalous POST requests to the /api/v2/job_invocations endpoint, specifically monitoring the 'effective_user' field for shell metacharacters or unexpected input patterns.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-01T18:13:20Z","date_published":"2026-10-01T18:13:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-12405/","summary":"A command injection vulnerability in the rubygem-foreman_remote_execution component allows authenticated attackers to execute arbitrary shell commands via the Satellite API.","title":"Command Injection in Red Hat Satellite (CVE-2026-12405)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-12405/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-12423","version":"https://jsonfeed.org/version/1.1"}