A flaw was discovered in the rubyipmi gem that underpins the Baseboard Management Controller component of Red Hat Satellite. An attacker who can authenticate with host‑creation or host‑update privileges can craft a specially crafted BMC username that triggers the vulnerability. The result is remote code execution on the affected system, giving the attacker the ability to run arbitrary commands as the BMC process. This vulnerability is a case of operating‑system command injection (CWE‑78).

Red Hat Satellite 6 and its sub‑versions 6.16, 6.17, and 6.18 for RHEL 8 and RHEL 9, as well as the Satellite capsule, maintenance, and utilities packages that rely on rubyipmi. The affected CPEs indicate that any component built with rubyipmi in the specified versions is vulnerable.

The CVSS score is 8.3, indicating a severe risk level. The EPSS score is reported as <1 %, meaning real‑world exploitation is currently considered unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires authenticated host permissions, the attack vector is most likely internal or by an attacker who gains the ability to create or update host definitions. The resulting impact is compromise of the host on which the BMC process runs, potentially affecting the entire satellite‑managed infrastructure.