CVE-2026-0980 Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username
An authenticated attacker with host permissions can achieve remote code execution on Red Hat Satellite by injecting commands via a malicious BMC username.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0980?
CVE-2026-0980 is a high-severity command injection vulnerability in Redhat Satellite, published on 27 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote code execution (RCE) on the system.
Weakness: CWE-78
Which versions are affected by CVE-2026-0980?
2 open source packages ship an affected version, including rubyipmi. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rubyipmi RubyGems | All versions | 0.13.0 |
rubyipmi RubyGems | All versions | 0.13.0 |
Products include Logicminds Rubyipmi, Redhat Satellite.
How do I fix CVE-2026-0980?
Upgrade rubyipmi to 0.13.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-0980 being exploited?
There is no known exploitation of CVE-2026-0980 in the wild and no public exploit code.
Sources
Also known as GHSA-hfcp-477w-3wjw.