Red Hat Satellite
CVE-2026-12515
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L required as a Satellite account with edit_products is mandatory; C:L only since solely content-existence metadata is disclosed, not content data.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
AnalysisAI
Insufficient authorization in the Katello ContentUploadsController within Red Hat Satellite 6 permits authenticated users holding only the edit_products permission to query content metadata for repositories belonging to products they have no rights to manage. The flaw, rooted in a missing ActiveRecord scope on repository lookup, allows cross-product content-existence enumeration via the content-upload API - but explicitly does not permit modification, import, or publication of content. No public exploit exists and the vulnerability is not listed in CISA KEV; risk is bounded by the authentication requirement and the limited read-only impact.
Technical ContextAI
The vulnerability resides in Katello's Ruby on Rails API controller at app/controllers/katello/api/v2/content_uploads_controller.rb. The root cause (CWE-862, Missing Authorization) is a single-line oversight in the destroy action: the repository lookup was performed with Repository.find(params[:repository_id]), a global ActiveRecord query that applies no tenancy or permission scope. The fix in upstream PR #11712 replaces this with Repository.editable.find(params[:repository_id]), which constrains the lookup to repositories the authenticated caller actually has edit rights over. The affected surface is Katello's content-upload REST endpoint used during content ingestion workflows for RPMs, files, and other repository content. CPE data confirms the affected products are Red Hat Satellite 6 (cpe:2.3:a:red_hat:red_hat_satellite_6:*:*:*:*:*:*:*:*) and Red Hat Hardened Images (cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*).
RemediationAI
The upstream code fix is available in Katello GitHub pull request #11712 at https://github.com/Katello/katello/pull/11712, which scopes the repository lookup in ContentUploadsController to repositories the requesting user has edit rights over. A released patched version of Red Hat Satellite 6 has not been independently confirmed from the available input data - the fix exists at the upstream PR level only; monitor https://access.redhat.com/security/cve/CVE-2026-12515 for an official Red Hat errata package before applying. As a compensating control pending the patch, restrict the edit_products permission to fully-trusted administrators only, reducing the pool of accounts capable of abusing this endpoint; note this may limit delegation workflows. A secondary control is to restrict API access to Satellite's content-upload endpoints at the network perimeter to management networks only, accepting the trade-off of reduced automation flexibility for external systems.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a malic
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated pack
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_key
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today