diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index d83fbd9185..26cbe8b50a 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: 3.8
+          python-version: 3.12
       - name: Install yamllint
         run: |
           python -m pip install --upgrade pip
diff --git a/gems/foreman_remote_execution/CVE-2026-12405.yml b/gems/foreman_remote_execution/CVE-2026-12405.yml
new file mode 100644
index 0000000000..297f6e14fd
--- /dev/null
+++ b/gems/foreman_remote_execution/CVE-2026-12405.yml
@@ -0,0 +1,50 @@
+---
+gem: foreman_remote_execution
+cve: 2026-12405
+ghsa: 9jhx-3c73-g9rh
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-12405
+title: Foreman_Remote_Execution - command injection via effective_user
+date: 2026-10-01
+description: |
+  A flaw was found in rubygem-foreman_remote_execution. A command
+  injection vulnerability exists in the Red Hat Satellite API
+  (/api/v2/job_invocations). When a job template has the effective_user
+  property marked as overridable: true, the application fails to
+  properly sanitize the effective_user input provided during the
+  API request. The exploitation does not rely on the content or logic
+  of the Job Template/playbook itself; rather, the injection occurs
+  during the instantiation of the job execution environment by the
+  Satellite server. An attacker with permissions to execute job
+  templates can inject arbitrary shell commands into this parameter,
+  which are executed on the target infrastructure with the privileges
+  of the execution user.
+cvss_v3: 8.8
+patched_versions:
+  - "~> 16.6.6"
+  - "~> 17.2.2"
+  - ">= 18.0.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-12405
+    - https://rubygems.org/gems/foreman_remote_execution/versions/18.0.1
+    - https://github.com/theforeman/foreman_remote_execution/compare/v18.0.0...v18.0.1
+    - https://github.com/theforeman/foreman_remote_execution/pull/1072
+    - https://rubygems.org/gems/foreman_remote_execution/versions/17.2.2
+    - https://github.com/theforeman/foreman_remote_execution/compare/v17.2.1...v17.2.2
+    - https://github.com/theforeman/foreman_remote_execution/pull/1074
+    - https://rubygems.org/gems/foreman_remote_execution/versions/16.6.6
+    - https://github.com/theforeman/foreman_remote_execution/compare/v16.6.5...v16.6.6
+    - https://github.com/theforeman/foreman_remote_execution/pull/1073
+    - https://projects.theforeman.org/issues/39836
+    - https://access.redhat.com/errata/RHSA-2026:74503
+    - https://access.redhat.com/security/cve/CVE-2026-12405
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2488952
+    - https://access.redhat.com/errata/RHSA-2026:74504
+    - https://access.redhat.com/errata/RHSA-2026:74506
+    - https://access.redhat.com/errata/RHSA-2026:74505
+    - http://www.openwall.com/lists/oss-security/2026/10/07/11
+    - https://github.com/advisories/GHSA-9jhx-3c73-g9rh
+notes: |
+  - cvss_v3 from nvd.nist.gov and GHSA URLs.
+  - date from GHSA URL.
+  - Unreviewed GHSA advisory