Red Hat Satellite
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Satellite.
Recent Red Hat Satellite Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:99952 | (RHSA-2026:99952) Critical: Satellite 6.18.11 Async Update | November 12, 2026 |
| RHSA-2026:99950 | (RHSA-2026:99950) Critical: Satellite 6.17.13 Async Update | November 12, 2026 |
| RHSA-2026:99949 | (RHSA-2026:99949) Critical: Satellite 6.16.15 Async Update | November 12, 2026 |
| RHSA-2026:95655 | (RHSA-2026:95655) Critical: Satellite 6.16 EUS security update | November 5, 2026 |
| RHSA-2026:95719 | (RHSA-2026:95719) General availability of the satellite/iop-advisor-backend-rhel9 container image | November 5, 2026 |
| RHSA-2026:95716 | (RHSA-2026:95716) satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview | November 5, 2026 |
| RHSA-2026:95715 | (RHSA-2026:95715) satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview | November 5, 2026 |
| RHSA-2026:95703 | (RHSA-2026:95703) General availability of the satellite/iop-advisor-backend-rhel9 container image | November 5, 2026 |
| RHSA-2026:95682 | (RHSA-2026:95682) General availability of the satellite/iop-yuptoo-rhel9 container image | November 5, 2026 |
| RHSA-2026:95678 | (RHSA-2026:95678) Technical preview of the satellite/iop-vmaas-rhel9 container image | November 5, 2026 |
By the Year
In 2026 there have been 191 vulnerabilities in Red Hat Satellite with an average score of 7.4 out of ten. Last year, in 2025 Satellite had 7 security vulnerabilities published. That is, 184 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.19.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 191 | 7.43 |
| 2025 | 7 | 6.24 |
| 2024 | 11 | 6.88 |
| 2023 | 7 | 7.77 |
| 2022 | 7 | 6.55 |
| 2021 | 9 | 6.68 |
| 2020 | 3 | 7.05 |
| 2019 | 39 | 5.49 |
| 2018 | 60 | 5.96 |
It may take a day or so for new Satellite vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Satellite Security Vulnerabilities
Foreman SSH Key Authorization Bypass via API
CVE-2026-86324
4.3 - Medium
- November 12, 2026
A flaw was found in Foremans Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another users ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victims managed hosts.
Insecure Direct Object Reference / IDOR
Foreman API V2 MailNotifications Auth Bypass & Access Control Flaw
CVE-2026-86323
4.3 - Medium
- November 12, 2026
A flaw was found in Foremans Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that users notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another users mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.
Insecure Direct Object Reference / IDOR
Foreman API Personal Access Token IDOR
CVE-2026-86322
8.8 - High
- November 12, 2026
A flaw was found in Foremans Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another users ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.
Insecure Direct Object Reference / IDOR
Candlepin Missing Auth Check Enables Cross-Org Consumer Registration
CVE-2026-111456
7.1 - High
- November 12, 2026
A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer.
Insecure Direct Object Reference / IDOR
Foreman API Host-Template Render Info Disclosure (Auth)
CVE-2026-107443
7.7 - High
- November 12, 2026
A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.
AuthZ
Ruby Safemode Gem Remote Method Invocation via Compound Assignment
CVE-2026-107360
9.6 - Critical
- November 12, 2026
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
Allowlist / Allow List
Foreman smart_proxy_dynflow Auth Bypass via Client Cert (CVE2026107152)
CVE-2026-107152
7.1 - High
- November 12, 2026
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.
authentification
Pulpcore Python EL Injection in HeaderContentGuard (CVE-2026-123084)
CVE-2026-123084
6.5 - Medium
- November 10, 2026
An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the **Pulpcore** package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for content. The filter is not limited to the header, and jq's env builtin also returns the environment of the content process. A low-privileged network attacker or user who can create a header content guard and attach it to a distribution can save a filter that reads that environment. The content request is allowed or denied according to the filter result. Repeating the request lets that attacker or user recover the environment, including Pulp settings held there, such as the Django secret key or the database password.
EL Injection
Ansible-Core git module argument injection (CVE-2026-84503)
CVE-2026-84503
6.7 - Medium
- November 09, 2026
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Argument Injection
Ansiblecore User Module Symlink PrivEsc via SSH Key Generation
CVE-2026-123037
6.7 - Medium
- November 06, 2026
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
insecure temporary file
Keycloak kcadm CLI Truststore Hostname Validation Bypass
CVE-2026-96453
8 - High
- November 05, 2026
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
Improper Certificate Validation
Keycloak SAML Adapter Issuer Mismatch (CVE-2026-93998)
CVE-2026-93998
7.4 - High
- November 05, 2026
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
Improper Verification of Cryptographic Signature
RESTEasy 7.0.2 Final - Unhandled Exception Leak via Default Mapper
CVE-2026-120971
5.3 - Medium
- November 03, 2026
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Generation of Error Message Containing Sensitive Information
Foreman permission filter bypass enables unauthorized filter deletion
CVE-2026-107193
6.5 - Medium
- October 12, 2026
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.
Insecure Direct Object Reference / IDOR
Ansible Core Tarball Path Traversal via Symlink Chain Exploit
CVE-2026-89091
8.8 - High
- October 08, 2026
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.
insecure temporary file
Pulp RPM plugin directory traversal write vulnerability
CVE-2026-103870
5 - Medium
- October 07, 2026
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.
Directory traversal
Candlepin Authorization Bypass via @Verify Parameter Flaw
CVE-2026-106471
8.1 - High
- October 07, 2026
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
AuthZ
Katello RegistryProxiesController Auth Bypass Enables User Enumeration
CVE-2026-56098
4.3 - Medium
- October 01, 2026
A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.
Side Channel Attack
Foreman Tail Utility OS Command Injection via Unsafe Eval
CVE-2026-12542
5.3 - Medium
- October 01, 2026
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Shell injection
Command Injection in Hammer CLI via $EDITOR Interpolation
CVE-2026-12545
6.7 - Medium
- October 01, 2026
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).
Shell injection
Red Hat Katello SQLi in RegistryProxiesController
CVE-2026-56097
6.5 - Medium
- October 01, 2026
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.
SQL Injection
Foreman Viewer Priv Info Disclosure & RCE via Template Preview
CVE-2026-96659
9.1 - Critical
- October 01, 2026
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user to execute arbitrary commands as the Foreman system account.
Privilege Defined With Unsafe Actions
Foreman RCE: SafeMode Templating Bypass
CVE-2026-96658
8.8 - High
- October 01, 2026
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
Code Injection
Foreman Vulnerable Multi-Stage Execution Enables SSTI & RCE
CVE-2026-12544
7.7 - High
- October 01, 2026
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code execution, total infrastructure compromise and supply chain risk.
Marshaling, Unmarshaling
Foreman OS Command Injection via foreman-rake db:dump/db:import_dump
CVE-2026-12541
8.2 - High
- October 01, 2026
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Shell injection
Foreman Rake Task Command Injection via errors:fetch_log
CVE-2026-12540
8.2 - High
- October 01, 2026
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Shell injection
Foreman Auth Bypass via host_verifier.rb in Satellite API
CVE-2026-12423
7.5 - High
- October 01, 2026
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
Missing Authentication for Critical Function
Red Hat Satellite API Job Injection via rubygem-foreman_remote_execution
CVE-2026-12405
8.8 - High
- October 01, 2026
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.
Shell injection
Red Hat Pulp Core Path Traversal via file_url in Content Upload API
CVE-2026-90959
8.1 - High
- September 24, 2026
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.
Directory traversal
RESTEasy CorsFilter CORS Misconfig Enables Credentialed CrossOrigin Access
CVE-2026-89058
7.4 - High
- September 18, 2026
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Origin Validation Error
RESTEasy IIOImageProv Unbounded Image Dimension DoS
CVE-2026-89059
7.5 - High
- September 18, 2026
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Data Amplification
Foreman Remote Exec Plugin: Unchecked Permission Filter Exposes Job Invocations
CVE-2026-92904
4.3 - Medium
- September 17, 2026
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.
AuthZ
Redis Community Cluster Bus OOB Read via Unchecked Null-Termination
CVE-2026-92925
7.1 - High
- September 17, 2026
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
Out-of-bounds Read
Foreman Ansible Plugin: Unscoped Host Query Exposes Hidden Parameters
CVE-2026-92893
4.3 - Medium
- September 17, 2026
A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden.
AuthZ
Privilege Escalation: Auth User Deletes Ansible Override Values in Foreman Ans Plugin
CVE-2026-92894
4.3 - Medium
- September 17, 2026
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the edit_ansible_variables permission can delete any LookupValue by ID, including override values for Ansible variables outside their permission filter scope and override values belonging to Puppet smart class parameters.
AuthZ
sequoia-openpgp Key Flag Flaw Allows Subkey Bypass & Signature Forgery
CVE-2026-42784
7.4 - High
- September 16, 2026
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Improper Verification of Cryptographic Signature
Stored XSS via HTML/SVG in pulpcore content serving
CVE-2026-84232
5.4 - Medium
- September 01, 2026
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.
XSS
SSRF via JMXServiceURL bypass in Jolokia JSR-160 proxy
CVE-2026-84218
8.1 - High
- September 01, 2026
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.
Denylist / Deny List
XXE in RESTEasy SourceProvider Enables Remote File Read
CVE-2026-17615
7.5 - High
- August 31, 2026
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
XXE
OOB Write in libsolv .solv Cache Rewrite Causing DoS
CVE-2026-82327
5.5 - Medium
- August 28, 2026
A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.
out-of-bounds array index
Katello API Auth Bypass: Unauthorized Cross-Org Content View Filter Access
CVE-2026-81668
5.4 - Medium
- August 27, 2026
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.
Insecure Direct Object Reference / IDOR
Foreman: Unauthorized Disclosure via Audited Template Revision Endpoint
CVE-2026-81658
6.5 - Medium
- August 27, 2026
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.
Insecure Direct Object Reference / IDOR
Katello CVH API Auth Bypass: Unauthorized Org Access
CVE-2026-79654
4.3 - Medium
- August 26, 2026
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.
Insecure Direct Object Reference / IDOR
Insights Core: Password redaction flaw exposes LDAP & fence creds
CVE-2026-19391
6.5 - Medium
- August 11, 2026
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
Cleartext Storage of Sensitive Information
Ansible-core Git URL Injection Enables Cmd Exec
CVE-2026-16493
7.8 - High
- July 21, 2026
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
Argument Injection
Pulpcore Path Traversal in FilesystemExport Enables Arbitrary File Write
CVE-2026-12701
9 - Critical
- July 20, 2026
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Directory traversal
libsolv PGP EdDSA Buffer Overflow (CVE-2026-48863)
CVE-2026-48863
7.5 - High
- July 16, 2026
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.
Stack Overflow
Auth Bypass in Foreman's Taxonomy Controller Exposing CrossTenant Data
CVE-2026-5138
4.3 - Medium
- July 01, 2026
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomy_scope controller method does not properly validate organization and location IDs from nested request parameters, bypassing existing authorization checks. This allows the user to leak sensitive infrastructure metadata, including subnet topology, IP ranges, gateways, DNS servers, and VLAN IDs, from organizations and locations they are not authorized to access.
Insecure Direct Object Reference / IDOR
Foreman Host Retarget Bypass via Broken Access Control
CVE-2026-5135
6.5 - Medium
- July 01, 2026
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing authorisation checks. The consequence is the potential for unauthorised modification of managed host configurations across different organisational and location boundaries.
Insecure Direct Object Reference / IDOR
Foreman SSH Key Leak via View_Keypairs Permission
CVE-2026-5142
6.5 - Medium
- July 01, 2026
A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.
Insecure Direct Object Reference / IDOR
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Satellite or by Red Hat? Click the Watch button to subscribe.
