CVE-2026-1961
Published: 26 March 2026
Summary
CVE-2026-1961 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1961 is a command injection vulnerability (CWE-78) in the WebSocket proxy implementation of Foreman. The issue arises from Foreman's use of unsanitized hostname values supplied by compute resource providers when constructing shell commands, affecting Foreman installations that integrate with external compute resources for VM management.
A remote attacker who operates a malicious compute resource server can exploit this vulnerability when a low-privileged user accesses VM VNC console functionality through Foreman. This requires user interaction and low privileges (PR:L), enabling remote code execution on the Foreman server over the network with low attack complexity. Successful exploitation could compromise sensitive credentials and the entire managed infrastructure, as reflected in the CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Red Hat has issued multiple security errata addressing this vulnerability, including RHSA-2026:5968, RHSA-2026:5970, and RHSA-2026:5971. Additional details are available on the Red Hat CVE page for CVE-2026-1961 and Bugzilla entry #2437036, which provide patch information and mitigation guidance for affected Foreman deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16167
Vulnerability details
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By…
more
operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in a web management app directly enables RCE via exploitation of a public-facing service (T1190) and Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of unsanitized hostname inputs from compute resource providers to prevent command injection in shell command construction.
Mandates timely remediation of the specific command injection flaw through application of Red Hat security errata patches.
Restricts hostname inputs to organization-defined safe classes, limiting opportunities for command injection payloads from malicious compute resources.