A command injection flaw exists in a Foreman rake task that is designed to fetch log entries. The request_id parameter is fed directly into a shell command (typically grep) without adequate sanitization, allowing an attacker who can execute the rake task with sudo privileges to inject shell meta‑characters and run arbitrary commands. This yields full system compromise for the account performing the task and can expose all data the account has access to. The weakness is identified as CWE-78, which denotes OS command injection.

The vulnerability affects Red Hat Satellite 6, including the 6.19 release for RHEL 9, as well as associated capsule and utilities components. The affected packages are those that provide the foreman‑rake errors:fetch_log command; the advisory recommends updating any installed Satellite 6 RPMs that contain this task.

The CVSS score of 8.2 indicates a high impact and ease of exploitation, but the attack requires that the attacker already possess sufficient privileges to invoke the rake task. The EPSS score of 1% indicates a very low but non‑zero exploitation probability. The location is not listed in the CISA KEV catalog, suggesting that no widespread, zero‑day exploitation is known at this time. Nevertheless, the high severity rating and ability for arbitrary code execution make this a critical issue pending a vendor fix.