CVE-2025-10622: Red Hat Satellite Foreman RCE Vulnerability

CVE-2025-10622 Overview

CVE-2025-10622 is a command injection vulnerability [CWE-78] in the Foreman component of Red Hat Satellite. An authenticated user holding the edit_settings permission can bypass server-side command whitelisting and execute arbitrary operating system commands on the Satellite server.

The weakness stems from insufficient validation of input passed to commands executed by Foreman. Successful exploitation results in arbitrary command execution under the privileges of the Satellite service account, with potential to compromise managed hosts across the infrastructure.

Critical Impact
An authenticated attacker with edit_settings permissions can achieve arbitrary command execution on the Satellite host, gaining a foothold to pivot into the wider managed environment.

Affected Products

Red Hat Satellite (Foreman component)
Red Hat Satellite versions addressed by RHSA-2025:19721, RHSA-2025:19832, RHSA-2025:19855, and RHSA-2025:19856
Upstream Foreman releases referenced in the Foreman Security Announcement 2025-10622

Discovery Timeline

2025-11-05 - CVE-2025-10622 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10622

Vulnerability Analysis

The Foreman component in Red Hat Satellite exposes administrative settings that can influence commands executed on the underlying operating system. Foreman applies a server-side whitelist intended to restrict the commands permitted through these settings.

The validation logic does not fully constrain user-supplied content. An authenticated user with the edit_settings permission can craft input that evades whitelist enforcement and reaches the OS command execution path. The result is OS command injection as classified under [CWE-78].

Because Satellite manages large fleets of Red Hat Enterprise Linux hosts, command execution on the Satellite server creates a high-value pivot point. The attack scope is marked as Changed in the CVSS vector, reflecting that exploitation impacts components beyond Foreman itself.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. Server-side validation logic that enforces command whitelisting in Foreman fails to reject all dangerous input patterns, permitting an authorized user to substitute or append arbitrary commands.

Attack Vector

Exploitation requires a network-reachable Foreman interface and a valid authenticated session holding the edit_settings administrative permission. The attacker modifies a vulnerable setting with a payload that defeats the whitelist check.

When Foreman later invokes the affected command, the injected payload runs on the host. The high privileges required and high attack complexity narrow the realistic attacker population to insiders or actors who have already compromised an administrative account.

No public proof-of-concept exploit is currently published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is reported as 0.508%.

Detection Methods for CVE-2025-10622

Indicators of Compromise

Unexpected modifications to Foreman administrative settings, particularly those tied to command execution, performed by accounts with edit_settings permissions.
Child processes spawned by the Foreman or Puma application processes that invoke shells (/bin/sh, /bin/bash) or system utilities such as curl, wget, nc, or python.
New cron jobs, systemd units, or SSH keys created on the Satellite server outside of authorized change windows.
Outbound connections from the Satellite host to unknown external infrastructure shortly after a settings change.

Detection Strategies

Audit Foreman application logs and the audits table for changes to settings made by accounts with edit_settings and correlate against ticketed change activity.
Monitor process lineage on the Satellite server for unusual descendants of the Foreman service that execute shell or scripting interpreters.
Alert on writes to sensitive paths such as /etc/cron.d/, /etc/systemd/system/, and user .ssh/authorized_keys files on Satellite hosts.

Monitoring Recommendations

Forward Foreman, Apache, and Puma logs together with Linux audit (auditd) telemetry to a central analytics platform for correlation.
Establish a baseline of expected Foreman child processes and alert on deviations.
Track administrative role assignments and review which accounts hold edit_settings on a recurring schedule.

How to Mitigate CVE-2025-10622

Immediate Actions Required

Apply the Red Hat Satellite updates published in RHSA-2025:19721, RHSA-2025:19832, RHSA-2025:19855, and RHSA-2025:19856.
Review all users and roles that grant the edit_settings permission and remove the permission from accounts that do not require it.
Rotate credentials and API tokens used by privileged Satellite accounts, especially if shared or stored in automation systems.
Audit recent Foreman settings changes for anomalous values and revert any unexpected modifications.

Patch Information

Red Hat has released fixed packages through the security advisories listed above. Customers should consult the Red Hat CVE Report for CVE-2025-10622 and the upstream Foreman Security Announcement 2025-10622 for version-specific guidance and component mappings.

Workarounds

Restrict the edit_settings permission to a minimal set of trusted administrators until patches are deployed.
Enforce multi-factor authentication on Satellite administrative accounts to reduce the risk of credential abuse.
Limit network access to the Satellite web interface and API to administrative networks or jump hosts.
Enable and review Foreman auditing to capture all setting changes for post-incident analysis.

bash

# Example: review users and roles with edit_settings on Satellite
hammer user list
hammer role list
hammer filter list --search 'permission = edit_settings'

# Apply Red Hat Satellite security updates
sudo satellite-maintain upgrade check
sudo satellite-maintain packages update