CVE-2026-0980: Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username
A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote code execution (RCE) on the system.
Other sources
Summary: Authorized RCE in Red Hat Satellite via rubyipmi gem used in the BMC component
Requirements to exploit: Satellite with the BMC component enabled, using ipmitool as the IPMI implementation. The attacker needs permissions to create (or update) existing hosts in Satellite, but not to manage Satellite.
Component affected: https://github.com/logicminds/rubyipmi
Version affected: <= 0.12.1
Patch available: yes
Version fixed (if any already): none yet
CVSS (optional): I don't believe in CVSS
Impact (optional): moderate
Embargo: no
Reason: one needs a specific setup and privileges in it to be able to exploit Suggested public date: dd-MMM-yyyy (It is important to note that an embargo may be lifted before there is a fix if necessary)
Acknowledgement: <Name> <Company> of the reporter and if they want to be acknowledged
Steps to reproduce if available:
deploy Foreman/Satellite with --foreman-proxy-bmc true create a host with a BMC interface and use "admin; touch /var/log/foreman-proxy/hacked" as the username for the BMC (requires host create/edit permissions, but not admin) refresh the host in the UI for Foreman to fetch the BMC status see /var/log/foreman-proxy/hacked was created Mitigation if available: use freeipmi or apply patch
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0980?
CVE-2026-0980 is classified as a high-severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2026-0980?
To fix CVE-2026-0980, update rubyipmi to version 0.13.0 or later.
What systems are affected by CVE-2026-0980?
CVE-2026-0980 affects rubyipmi versions up to 0.12.1 and Red Hat Satellite version 6.0.
What types of attacks can exploit CVE-2026-0980?
CVE-2026-0980 can be exploited by authenticated attackers with host creation or update permissions to execute malicious code.
Is there a way to mitigate CVE-2026-0980 without updating?
There are no known mitigations for CVE-2026-0980 aside from updating to a patched version.