Hi,

A security fix has been released in Foreman Remote Execution, an open-source plugin for Foreman, an open-source lifecycle management tool for physical and virtual servers.

CVE-2026-12405: Foreman Remote Execution: command injection via effectiveuser

An authenticated user with permission to execute job templates can inject commands through the overridable effectiveuser parameter during job invocation. Improper input handling allows command execution with the execution user's privileges on managed hosts.

Affected versions: Foreman Remote Execution 0.1.2–16.6.5, 16.7.0, 17.0.0–17.2.1, and 18.0.0 CVSS: 8.8 (Important) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fixed versions: Foreman Remote Execution 16.6.6, 17.2.2, and 18.0.1 Credit: Guilherme Suckevicz

References: - Foreman Security: https://theforeman.org/security.html#2026-12405 - Redmine: https://projects.theforeman.org/issues/39836 - Fix: https://github.com/theforeman/foremanremoteexecution/pull/1072

Thanks, Ondrej Gajdusek Foreman Release Team

A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key. This issue does not directly allow unauthorized remote execution on the Satellite, although it can leak secrets that may lead to it.