EUVD-2026-94155
GHSA-993v-gm7c-q4cq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network API reachable with low complexity; requires a low-privilege account (PR:L) and no user interaction; high confidentiality and integrity loss, no availability impact; scope unchanged as Candlepin stays the auth authority.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
AnalysisAI
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logic flaw in its central access control filter: when an API operation verifies multiple @Verify-annotated parameters, access is granted if any one of them is permitted rather than requiring permission on all of them. An authenticated attacker with a low-privilege account who legitimately can reach the first referenced object can therefore pass authorization checks on later parameters and, provided they know the victim resource identifiers, read consumer information or modify entitlements and subscription resources - including objects belonging to other organizations (CVSS 3.1: 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege authenticated account on the Candlepin/Satellite instance (PR:L) and knowledge of the target resource identifiers - consumer UUIDs, entitlement IDs, or subscription resource IDs ('When target resource identifiers are known' per the description). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for organizations running Red Hat Satellite 6 / Candlepin, though several signals are missing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data - the references point to the Red Hat CVE advisory and the Red Hat Bugzilla tracking bug rather than a fixed errata, so confirm current patch status at https://access.redhat.com/security/cve/CVE-2026-106471 and https://bugzilla.redhat.com/show_bug.cgi?id=2547044 and apply the vendor fix as soon as Red Hat publishes it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Satellite 6 and standalone Candlepin 0.x/4.x deployments, confirm which are internet- or cross-tenant reachable, and restrict API and web UI access to trusted management networks; simultaneously pull the list of all Candlepin accounts and disable or downgrade any that are not strictly required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permi
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repositor
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today