Red Hat Satellite CVE-2026-79654

Exploitation requires an active authenticated session to the Red Hat Satellite 6 API with at minimum the 'view Content Views' permission granted in any organization on the instance - no administrative rights are needed. The vulnerability is a multi-tenant isolation failure and only applies when multiple organizations are configured within the same Satellite server; a Satellite deployment with a single organization configured has no cross-org boundary to cross and is not exposed to this specific risk. The attacker must know or successfully enumerate Content View IDs belonging to another organization; IDs are typically sequential integers, making enumeration trivial once API access is established. Exploitation is strictly limited to read-only disclosure of lifecycle metadata - no modification, deletion, or privilege escalation is possible through this flaw. Per CVSS PR:L, a standard low-privilege authenticated account (not anonymous or unauthenticated access) is required.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes this as a low-complexity, network-reachable flaw that any authenticated Satellite user can attempt without elevated privileges. Real-world risk is bounded by two factors: the impact is strictly confidential metadata disclosure with no write or availability consequence, and the vulnerability only materializes in multi-organization Satellite deployments - single-org instances gain no additional attack surface. EPSS data was not provided; given the niche enterprise footprint of Red Hat Satellite compared to broadly deployed infrastructure software, widespread automated scanning is implausible. No CISA KEV listing and no public exploit code are confirmed at time of analysis, which is consistent with the low-to-moderate urgency implied by the CVSS score. The primary realistic threat is an insider or a low-privileged user in one organizational unit enumerating content management activity in a peer organizational unit on the same Satellite server, which could aid internal reconnaissance by revealing what software is being published and promoted, by whom, and when - information that could expose organizational structure or patch cadence.

An authenticated Satellite user assigned to Organization A - holding only the standard 'view Content Views' permission - iterates through integer Content View IDs via the Content View History REST API endpoint, retrieving lifecycle records for Content Views owned by Organization B. The attacker learns which repositories were published and promoted, when, and by which internal usernames, enabling reconnaissance of a peer team's patch management cadence. No public exploit code exists at time of analysis, but the low technical bar means a short API script or even manual curl requests are sufficient.