{"id":"CVE-2026-1961","summary":"Forman: foreman: remote code execution via command injection in websocket proxy","details":"A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.","modified":"2026-10-24T10:53:52.891277888Z","published":"2026-03-26T12:53:09.566Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"0:3.12.0.14-1.el8sat"},{"fixed":"0:3.12.0.14-1.el9sat"},{"fixed":"0:3.14.0.14-1.el9sat"},{"fixed":"0:0.1.23-0.3.el9pc"},{"fixed":"0:1.2.0-0.1.el9pc"},{"fixed":"0:4.2.28-0.1.el9pc"},{"fixed":"0:2.22.3-1.el9pc"},{"fixed":"0:3.27.10-2.el9pc"},{"fixed":"0:1.5.1-1.el9sat"},{"fixed":"0:0.4.3-1.el9sat"},{"fixed":"0:4.16.0.14-1.el9sat"},{"fixed":"0:0.13.0-1.el9sat"},{"fixed":"0:6.17.7-1.el9sat"},{"fixed":"0:0.0.3-4.el9sat"},{"fixed":"0:3.14.0.14-1.el9sat"},{"fixed":"0:0.1.23-0.3.el9pc"},{"fixed":"0:1.2.0-0.1.el9pc"},{"fixed":"0:4.2.28-0.1.el9pc"},{"fixed":"0:2.22.3-1.el9pc"},{"fixed":"0:3.27.10-2.el9pc"},{"fixed":"0:1.5.1-1.el9sat"},{"fixed":"0:0.4.3-1.el9sat"},{"fixed":"0:4.16.0.14-1.el9sat"},{"fixed":"0:0.13.0-1.el9sat"},{"fixed":"0:6.17.7-1.el9sat"},{"fixed":"0:0.0.3-4.el9sat"},{"fixed":"0:3.16.0.12-1.el9sat"}],"source":"AFFECTED_FIELD","strategy":"InverseAffectedRanges"}]}],"cna_assigner":"redhat","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1961.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/03/27/3"},{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1961.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5968"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5970"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5971"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-1961"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1961.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1961"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437036"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman","events":[{"introduced":"0"},{"fixed":"c4681ebbfeab757f072a674425a8d4a0b6fbe08d"},{"introduced":"f7ec9581e78dcceda8b9c060dd60966a35587d51"},{"fixed":"55b3ba2b60e20f6f94f85364148ae048d5b8b980"},{"introduced":"64df953105d9f70fbe741ad032fb3067ccd9f32a"},{"fixed":"f0995038821515a88bd0edbe37eaea50bc62e9b8"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"3.16.3"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"3.17.0"},{"fixed":"3.17.2"}],"source":"CPE_RANGE"},{"range":[{"introduced":"3.18.0"},{"fixed":"3.18.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"}]}}],"versions":["3.16.2","3.17.1","3.18.0","3.17.0","3.16.1","3.16.0","3.16.0-rc2","3.16.0-rc1","1.1","1.1RC5","1.1RC4","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC5","1.0RC4","1.0RC3","1.0RC2","1.0RC1","0.4","0.4rc5","0.4rc4","0.4rc3","0.4rc2","0.3","0.2","0.2rc1","0.1-6","0.1-5","0.1-4","0.1-3","0.1-2","0.1-1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-1961.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman-installer","events":[{"introduced":"0"},{"fixed":"fd62debfbad81b58732282ef1267f87f1f94193e"},{"introduced":"a0f304c4871f803981f151a24e934d4c8cf0fe2c"},{"fixed":"dec70624a9f3ee86dbb3e4753feebe4c8e71a9b0"},{"introduced":"3227a0ee3846f4f3b4c27d38d3108f823e1289dc"},{"fixed":"90d218a8052c9f3c9e39951a5a93eda9870e23ae"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"3.16.3"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"3.17.0"},{"fixed":"3.17.2"}],"source":"CPE_RANGE"},{"range":[{"introduced":"3.18.0"},{"fixed":"3.18.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"}]}}],"versions":["3.16.2","3.17.1","3.18.0","3.17.0","3.16.1","3.16.0","3.16.0-rc2","3.16.0-rc1","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-1961.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/smart-proxy","events":[{"introduced":"0"},{"fixed":"141656e5294953d0fdae23752903bf3f03ac5f7d"},{"introduced":"5af91668078d31b3121c870f55167ce384ffb308"},{"fixed":"ebbfa5c3b33b0bad804c6091dd70e1ae5fe40a9c"},{"introduced":"514f2e6a501dfa79f287d63c498ebfdd5ce8891c"},{"fixed":"5fd123a13a27cc9cb4f26285da681a2ca5ebd3bd"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"3.16.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"3.17.0"},{"fixed":"3.17.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","range":[{"introduced":"3.18.0"},{"fixed":"3.18.1"}]}]}}],"versions":["3.16.2","3.17.1","3.18.0","3.17.0","3.16.1","3.16.0","3.16.0-rc2","3.16.0-rc1","1.1","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC2","1.0RC1","0.3","0.2","0.2rc2","0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-1961.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}