CVE-2026-12405

Name of the Vulnerable Software and Affected Versions rubygem-foreman remote execution (affected versions not specified)

Description A command injection flaw exists in the Red Hat Satellite API endpoint '/api/v2/job invocations'. The issue occurs when a job template has the effective user property set to overridable: true, as the application does not properly sanitize the effective user input during the API request. This allows an attacker with permissions to execute job templates to inject arbitrary shell commands into the effective user parameter, which are then executed on the target infrastructure with the privileges of the execution user. The injection happens during the instantiation of the job execution environment by the Satellite server and is independent of the Job Template or playbook logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the effective user parameter in the '/api/v2/job invocations' API endpoint until the issue is resolved.