Red Hat Satellite EUVD-2026-41002

Exploitation requires an authenticated session in Foreman/Satellite with the 'view_keypairs' permission assigned via RBAC - unauthenticated access is not possible (CVSS PR:L). The vulnerability is only meaningful in multi-tenant Satellite deployments with two or more configured organizations sharing a single instance; single-organization deployments have no cross-tenant boundary to violate and are not at risk from this specific flaw. No special non-default configuration, feature flag, or elevated privilege beyond the 'view_keypairs' role is required. The attacker must have network access to the Satellite API (CVSS AV:N). Exploitation is bounded to confidentiality loss only - no write access to key material, no modification of other organizations' resources, and no availability impact is achievable through this attack path alone.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scoring 6.5 Medium accurately reflects the core risk profile: network-exploitable with no attack complexity, but gated behind authenticated access and a specific RBAC permission ('view_keypairs'). The high confidentiality impact is justified - private SSH keys are high-value credential material enabling lateral movement across all hosts managed by the target organization. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be assessed numerically. No KEV listing and no reported POC indicate opportunistic mass exploitation has not been observed. The practical risk escalates significantly in managed service provider environments or large enterprises running multi-organizational Satellite deployments, where 'view_keypairs' may be granted broadly for provisioning workflows. There is no conflict between the CVSS vector and the description - both confirm network-accessible exploitation requiring low-privilege authentication without user interaction.

An authenticated attacker in Organization A with the 'view_keypairs' role issues direct HTTP requests to Satellite's key pair API endpoint, incrementing or probing key pair IDs that fall outside their assigned organization's taxonomy scope. Because the server validates the permission but not the organizational ownership of the requested object, it returns the private SSH key material for Organization B's key pairs. The attacker then uses the exfiltrated private keys to authenticate directly to managed hosts belonging to Organization B without further exploitation steps. No public exploit code has been identified at time of analysis, but the attack pattern is elementary API enumeration requiring only knowledge of the endpoint structure.