A command injection flaw exists in the Red Hat Satellite API endpoint /api/v2/job_invocations when the effective_user field of a job template is marked overridable:true. The application fails to sanitize the effective_user value supplied in the API request, allowing an attacker to inject arbitrary shell commands. The injected commands execute on the target hosts with the privileges of the job’s execution user, giving the attacker complete control over those hosts. This vulnerability is a classic example of CWE‑78 (OS Command Injection). The impact is remote code execution on all target machines that run the job template, regardless of the content or logic of the playbook itself.

This issue affects Red Hat Satellite 6, 6.16 for RHEL 8, 6.16 for RHEL 9, 6.18 for RHEL 9, and 6.19 for RHEL 9. Affected packages include satellite, satellite_capsule, and satellite_utils at the corresponding versions. The vulnerability is present whenever the API is exposed to clients that have permission to invoke job templates.

The CVSS base score is 8.8, indicating a severe risk level. The EPSS score is 1% and the vulnerability is not listed in CISA’s KEV catalog. Attackers need network access to the Satellite API and must possess the privilege to execute job templates. Once that condition is met, the flaw can be exploited remotely without further device compromise, making it a high‑risk, moderately likely threat in environments where job execution rights are too broadly granted.