An attacker can achieve remote code execution by exploiting an unsanitized hostname in Foreman's WebSocket proxy, which is used when building shell commands. The flaw allows injection of arbitrary shell commands if the attacker can control the hostname returned by a compute resource provider. Successful exploitation could compromise credentials stored on the system and ultimately control the entire managed infrastructure.

Red Hat Satellite (versions 6, 6.16, 6.17, 6.18) running on RHEL 8 or 9, including Satellite Capsule, Satellite Maintenance, and Satellite Utils components. These products are listed by the CNA and affect multiple minor releases in both RHEL 8 and RHEL 9 distributions.

The vulnerability has a CVSS score of 8 and an EPSS score below 1%, indicating low current exploitation probability. It is not listed in the CISA KEV catalog. A likely attack vector involves an attacker operating a malicious compute resource, providing a hostname that is used by Foreman's proxy. When an authenticated user accesses VNC console functionality, the unsanitized hostname is incorporated into a shell command, allowing arbitrary code execution. Because the flaw requires control over a compute resource, initial access may be limited, but the impact of successful exploitation is severe.