Introduction
Attackers with legitimate access to Red Hat Satellite can escalate privileges and execute arbitrary commands on the underlying operating system if edit_settings permissions are mismanaged. The flaw is in the Foreman component, which handles provisioning and configuration for many enterprise Linux environments.
Red Hat Satellite is a widely deployed infrastructure management platform for Red Hat Enterprise Linux. Large enterprises use it to automate system provisioning, configuration, and lifecycle management. Foreman, the upstream open-source project, sits at the core of Satellite's provisioning engine. Red Hat's products are a staple of enterprise IT, and they manage millions of systems worldwide.
Technical information
CVE-2025-10622 is a command injection vulnerability in Red Hat Satellite's Foreman component. The flaw is in how Foreman handles the ct_location and fcct_location parameters, which set the command locations used to transpile CoreOS and Fedora CoreOS templates. Any user with the edit_settings permission can set these parameters in the Foreman administrative interface.
The root cause is insufficient server-side validation of these parameters. Foreman does not enforce a strict whitelist or sanitize the values properly, so an attacker can inject shell metacharacters or command substitution syntax. When Foreman renders a provisioning template that uses the affected parameter, the injected command runs with the privileges of the Foreman process (typically the foreman system user).
The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-602 (Client-Side Enforcement of Server-Side Security). It is similar to the previously disclosed CVE-2022-3874, which affected the ct_command and fcct_command parameters in earlier Foreman versions.
No public code snippets of the vulnerable implementation are available. Public advisories do confirm that exploitation involves supplying a malicious value for the ct_location or fcct_location setting and then triggering template rendering.
Affected systems and versions
- Red Hat Satellite 6.18 x86_64
- Red Hat Satellite Capsule 6.18 x86_64
Only systems where users have the edit_settings permission are vulnerable. The issue is limited to the ct_location and fcct_location parameters in the Foreman component.
Vendor security history
Red Hat has a strong record of issuing timely advisories and patches for security issues. Its Product Security team typically responds quickly to reports and coordinates public disclosure with the patch release. Foreman, however, has had similar command injection vulnerabilities before, notably CVE-2022-3874 in the ct_command and fcct_command parameters. The recurrence of this vulnerability class suggests deeper architectural problems in how Foreman validates input and executes commands.
