Red Hat Satellite EUVD-2026-40281

Exploitation requires that the attacker possess high-privilege (administrative) access to the Foreman or Red Hat Satellite 6 web interface, specifically the ability to create or modify HTTP proxy entries via the http_proxies_controller. The Satellite server must be deployed in a cloud environment (AWS, GCP, or Azure) where the Instance Metadata Service is reachable from the server's network interface - this is the default configuration for cloud-hosted VMs unless IMDS access is explicitly blocked at the hypervisor or network layer. Exploitation is further limited by the AV:L vendor assessment, suggesting the attack may require local or console-level access rather than remote web UI access - defenders should verify whether the proxy configuration endpoint is exposed over the network. What limits exploitation: the PR:H requirement means a compromised standard user account is insufficient; the attacker must control an administrator-level Foreman account. Environments running Satellite on bare metal or in private data centers without cloud IMDS endpoints are not at risk of metadata theft, though SSRF to other internal services may still be possible.

The vendor-assigned CVSS 3.1 score of 4.4 (Medium) reflects significant access restrictions: AV:L (local vector) and PR:H (high privileges required) substantially limit exposure, confining exploitation to actors already holding Foreman/Satellite administrative access. The confidentiality impact is rated C:H, which is consistent with the real-world value of stolen cloud metadata credentials that can pivot to full cloud account compromise. No EPSS score was provided in the available data, and the vulnerability is not listed in CISA KEV, indicating no confirmed in-the-wild exploitation at time of analysis. The primary risk signal here is the downstream blast radius: while the barrier to entry is high (admin access required), successful exploitation in a cloud-hosted Satellite deployment could yield IAM credentials enabling lateral movement across the entire AWS/GCP/Azure tenant. There is a notable discrepancy between the AV:L assignment and the web-controller nature of the vulnerable component - if the http_proxies_controller is network-accessible (as is typical for Foreman's web UI), the effective attack vector may be broader than AV:L suggests; defenders should verify with the vendor whether the attack surface includes the network-accessible web interface.

An attacker holding Foreman administrative credentials - obtained through credential theft, privilege escalation, or a compromised admin account - navigates to the HTTP proxies configuration interface and sets a proxy target URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/. When Foreman's backend processes the modified proxy parameter, it issues an HTTP GET to the AWS IMDS endpoint from the Satellite server's network context, returning temporary IAM role credentials (AccessKeyId, SecretAccessKey, Token) that the attacker can then exfiltrate and use to authenticate against AWS APIs. No public proof-of-concept exploit code has been identified, but the attack technique (SSRF to cloud IMDS) is well-documented and trivially replicable by any attacker familiar with the cloud metadata API structure.