Red Hat Satellite 6 CVE-2026-81658

Exploitation requires: (1) a valid Satellite account with at least one template-related permission such as view_ptables - this is a low-privilege role commonly assigned to operators; (2) network access to the Foreman/Satellite web interface (AV:N per CVSS vector); (3) knowledge or enumeration of at least one audit ID belonging to a template in a different organization or location. The flaw is limited to the template revision audit endpoint - the standard REST API revision endpoint is not affected. Exploitation is limited to read-only disclosure (C:H, I:N, A:N); no write or destructive capability is available through this vector. Single-organization Satellite deployments with no multi-tenancy are at lower risk since all templates belong to the same organization.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a network-accessible, low-complexity, low-privilege read-only flaw with high confidentiality impact. The primary risk amplifier is the potential for template revisions to contain embedded credentials or secrets - organizations that store passwords, API tokens, or private keys in Puppet/Ansible/provisioning templates face a materially higher effective risk than the numeric score suggests. The attack complexity is genuinely low: audit IDs are likely sequential integers, making enumeration trivial once a single valid ID is known. No KEV listing and no known public exploit code temper urgency, but the low privilege bar (any user with view_ptables or equivalent) means the attack surface within a multi-tenant Satellite deployment is broad. The Scope:Unchanged rating is consistent - the attacker cannot escape the application boundary - but lateral movement within a Satellite-managed infrastructure remains possible if harvested credentials enable access to managed hosts. EPSS data was not provided; given the targeted nature of Satellite deployments and the lack of public exploit, widespread opportunistic exploitation is unlikely at present.

An authenticated Satellite user with minimal view_ptables permission queries the template revision audit endpoint with incrementing integer audit IDs. By iterating through IDs, the attacker retrieves historical template contents belonging to other organizations or locations within the same Satellite instance, potentially harvesting credentials or private configuration data embedded in those templates. No public proof-of-concept code has been identified, but the enumeration approach requires no specialized tooling beyond standard HTTP requests.