A command‑injection flaw in Foreman’s WebSocket proxy allows a remote attacker to execute arbitrary shell commands on the Foreman server. The vulnerability originates from unsanitized hostname values supplied by compute resource providers that are incorporated into shell commands. If an attacker controls the hostname returned by a compute resource, accessing the VNC console can cause the injection of malicious code, potentially compromising credentials and the entire managed infrastructure.

Red Hat Satellite 6 and its subsequent releases—6.16 through 6.18—running on RHEL 8 or RHEL 9, including the Satellite Capsule, Satellite Maintenance, and Satellite Utils components, are affected as listed by the CNA.

The CVSS score of 8 indicates high severity, while the EPSS score of 1% shows that exploitation activity is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control a compute resource that returns a crafted hostname; when an authenticated user activates the VNC console, the unsanitized hostname is injected into a shell command, allowing arbitrary code execution. Although initial access is limited to the compute resource, the impact of a successful compromise is severe, potentially giving control over the entire managed environment.