High-Severity RCE Discovered in Foreman’s WebSocket Proxy

Security researchers disclosed CVE-2026-1961, a high-severity command injection vulnerability in Foreman’s WebSocket proxy that allows remote code execution when unsanitized hostnames from compute resource providers (e.g., vSphere, Libvirt) are executed by the server; it affects Foreman up to 3.18.0 (CVSS 8.0) and is patched in 3.18.1, 3.17.2, and 3.16.3 — administrators are urged to update immediately to prevent full Foreman server compromise.