CVE-2026-12405

{
  "etk_id": "ETK-2026-259",
  "cve_id": "CVE-2026-12405",
  "display_id": "CVE-2026-12405",
  "ghsa_id": "GHSA-9jhx-3c73-g9rh",
  "euvd_id": "EUVD-2026-90914",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Command injection in rubygem-foreman_remote_execution",
  "summary": "Red Hat Satellite deployments using rubygem-foreman_remote_execution are affected when a job template permits overriding its effective user. An authenticated user allowed to run job templates can cause shell commands to run on managed infrastructure with the configured execution user's privileges.",
  "mitigation": "Disable effective-user overrides on job templates and limit job-template execution permissions to trusted administrators. No fixed version is recorded in the advisory; restrict access to the job-invocation API until an updated package is available.",
  "vendor": "Red Hat",
  "product": "Red Hat Satellite 6.19 for RHEL 9",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "rubygem-foreman_remote_execution",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "satellite:el8/rubygem-foreman_remote_execution",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0154,
  "epss_percentile": 0.7453,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 98.39483585,
  "t0_at": "2026-10-01T16:21:44.040000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T16:21:44.040000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T16:21:44.040000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12405"
    }
  }
}