Red Hat Satellite 6
Monthly
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logic flaw in its central access control filter: when an API operation verifies multiple @Verify-annotated parameters, access is granted if any one of them is permitted rather than requiring permission on all of them. An authenticated attacker with a low-privilege account who legitimately can reach the first referenced object can therefore pass authorization checks on later parameters and, provided they know the victim resource identifiers, read consumer information or modify entitlements and subscription resources - including objects belonging to other organizations (CVSS 3.1: 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a valid account and prior knowledge of target consumer UUIDs, entitlement IDs, or subscription resource IDs, and is limited to endpoints that evaluate more than one verified parameter; no public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
OS command injection in the Foreman foreman-tail helper utility shipped with Red Hat Satellite 6.19 for RHEL 9 allows a local, authenticated user to execute arbitrary system commands with the privileges of whoever runs the tool, because unsanitized arguments are fed into an eval-based path-expansion string and shell metacharacters such as ;, & and | are interpreted as commands. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is strictly local-scope, so it only matters where a lower-privileged account on a Satellite/Foreman host can reach the utility and thereby escalate its privileges. There is no network-facing attack path, no public exploit code has been identified at time of analysis, and EPSS is low (0.55%, 44th percentile), though Red Hat has issued patched packages (for example 0:3.18.0.14-1.el9sat for Satellite 6.19 on RHEL 9) via several RHSA advisories.
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat: it is local-only, demands pre-existing delegated or privileged access to the rake tasks, and environments where only root invokes foreman-rake with no restricted sudo delegation are effectively not exposed; no public exploit code has been identified at time of analysis.
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can pull the kickstart provisioning template from Red Hat Satellite 6's /unattended/provision endpoint without supplying any token, provided a host is currently mid-provisioning and therefore has an unexpired token recorded in the Satellite database. The flaw is a semantic logic error in Foreman's host_verifier.rb: valid_host_token? validates database state rather than the token presented in the HTTP request, so the check passes even when the request carries no token. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), the exposure is gated by the provisioning window and yields information disclosure of the rendered template, not code execution; no public exploit code or active exploitation has been identified at time of analysis.
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman_remote_execution plugin, lets an authenticated Satellite user who holds job-template execution permissions run arbitrary shell commands on managed hosts. The injection only applies to job templates whose effective_user property is configured as overridable: true, in which case the user-supplied value is not sanitized before the Satellite server instantiates the job execution environment, so the payload executes during instantiation rather than through the template or playbook content itself. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), this requires an authenticated account (PR:L) and the non-default overridable setting, and no public exploit identified at time of analysis; Red Hat has published an erratum, RHSA-2026:74503.
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repository permissions to read arbitrary files accessible to the Pulp server process by submitting a crafted 'file:' URL through the 'file_url' parameter, which is dispatched to the file downloader despite an intended scheme check. Baseline impact is confidentiality loss on the Pulp host; in deployments that include Pulp Container the same flaw escalates to theft of the container registry token signing private key, enabling forged bearer tokens and unauthorized access to every private container repository in the registry. Downstream products embedding pulpcore are affected, including Red Hat Satellite 6, Red Hat Ansible Automation Platform 2, and Red Hat Update Infrastructure 4/5. There is no public exploit identified at time of analysis, and EPSS data was not provided; Red Hat tracks the issue under advisory https://access.redhat.com/security/cve/CVE-2026-90959.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. CVSS rates this 7.5 (High) with full confidentiality impact; no public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity unauthenticated network vector makes this a credible threat wherever RESTEasy-backed XML endpoints are exposed.
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-management permissions attach arbitrary roles - including the administrator role - to a user group and then enroll themselves, gaining full admin-level control. The Usergroup model fails to validate that the assigning user actually holds the roles being granted, breaking the RBAC delegation boundary. Rated CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and clear escalation path make it a strong patch priority.
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take over active administrative sessions by reusing leaked session IDs that the server caches without re-validating authentication tokens. Because session IDs are written to standard logs, any user with log read access can replay them to gain administrative control and pivot to infrastructure-wide code execution. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Command injection in Foreman's WebSocket proxy, as shipped in Red Hat Satellite 6, allows a malicious compute-resource provider to achieve remote code execution on the Satellite/Foreman server when a user opens a VM VNC console. The CVSS vector shows network access with no privileges (PR:N) but requires user interaction (UI:R), and practical exploitation depends on the attacker already controlling a registered compute resource that returns a crafted hostname; publicly available exploit code exists, while EPSS remains low at 0.12%.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Broken access control (CWE-863) in Foreman's domain and subnet interface API lets an authenticated user who already holds a host-view permission and can see a shared domain or subnet read interface records for hosts outside their authorized scope; the API checks the host permission but omits its search-limit filter, returning every interface on the domain or subnet. A user who also holds host-edit permission can persist a change to one of those out-of-scope interfaces, giving limited confidentiality and integrity impact (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Red Hat Satellite 6, which ships Foreman, is the affected product per CPE; no public exploit identified at time of analysis.
Authenticated users in Red Hat Satellite 6 (and the underlying Foreman permission-filter subsystem) can delete permission filters belonging to roles other than their own by abusing an API path that resolves filters by identifier without re-applying the caller's permission scope. The prerequisite is modest but not trivial: the attacker must already hold filter-delete rights for at least one role, and the victim roles must be unlocked - this is an insider or compromised semi-privileged account vector, not a default unauthenticated remote issue. Resulting impact is integrity-only (I:H, C:N/A:N) at CVSS 6.5, with other roles silently losing the access their deleted filters granted; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
An authorization flaw in Katello's Flatpak Remote Repositories API allows an authenticated user who is permitted to view flatpak remotes in one organization to retrieve flatpak remote repository records - including the stored credentials for that remote - belonging to a different organization. The same unscoped lookup is reused by the mirror action, so a user with edit rights on a product in their own organization can create a repository configured with another organization's flatpak remote URL and its stored remote credentials. Exploitation requires an authenticated account holding the flatpak-remote view permission, the flatpak remote feature to be in active use, and a multi-organization Red Hat Satellite 6 / Katello deployment; no public exploit code has been identified at time of analysis, and the flaw is a medium-priority authenticated authorization issue rather than an emergency.
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
Missing authentication in the smart_proxy_dynflow remote-execution callback handlers lets an unauthenticated network attacker forge progress and completion reports for a running job, causing the job to be recorded as a success or a failure with attacker-supplied output. The flaw (CWE-306) applies only when Red Hat Satellite 6 remote execution is configured in pull or pull-mqtt mode, and the attacker must already know the identifier of a live job and submit the forged report during that job's execution window, which is why the assessed severity is moderate (CVSS 5.9, AC:H, integrity-only). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Path traversal in pulp-rpm's distribution tree publishing allows an authenticated user with sync or upload privileges to write files outside the intended task work area on the Pulp server. Crafted addon or variant ids in a .treeinfo file are used as directory names without sanitization, enabling the creation of new directories and writing of repository metadata and packages as the Pulp worker user. This is an integrity-only issue with no data disclosure or service disruption; no public exploit has been identified, and the practical risk is lower than the base CVSS 5.0 suggests due to the required privileges and the create-only constraint.
Pulp Ansible's bearer-token refresh for collection remotes can disclose access tokens to an authenticated attacker who can create or sync a remote and point it at a malicious server. The attacker must then reuse the token at the issuing service, and exploitation is only possible if another token download for a different remote has run on the same worker process, meaning shared, multi-tenant deployments are primarily at risk. No public exploit code exists, and the assessed attack complexity is high (AC:H), so this is a moderate-priority information disclosure issue rather than a top-tier emergency.
Authenticated users with permission to create and sync container remotes in Pulp can obtain upstream registry credentials-usernames, passwords, or bearer tokens-stored for other remotes because the pulp-container worker reuses authentication material across sync operations. This affects deployments built on Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4/5, particularly multi-tenant environments where remotes share worker processes. No public exploit code or confirmed active exploitation has been identified; the flaw rates CVSS 6.5 (moderate) and requires no user interaction beyond the attacker's own sync, though it does require an authenticated user with remote-creation and sync privileges.
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. No public exploit identified at time of analysis; the vendor has released an errata (RHSA-2026:74503).
An authenticated low-privileged user can inject SQL through the Katello Registry Proxy in Red Hat Satellite 6 by placing a crafted label in the request path, allowing them to read arbitrary data from the Satellite database. The vulnerable code paths (check_blob_push_org_label and get_matching_products_from_org) interpolate request-supplied labels straight into raw SQL, and the only prerequisite is an account holding the create_personal_access_tokens permission - even a heavily restricted account with no Organization or Location assigned, which makes the effective privilege bar unusually low. Impact is limited to confidentiality (CVSS 6.5, C:H/I:N/A:N); no public exploit code has been identified at time of analysis, and Red Hat has published erratum RHSA-2026:74503 to address the flaw. This is a genuine but moderate-priority issue, not a critical drop-everything vulnerability.
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. Public exploit code and confirmed active exploitation are not indicated in the available intelligence, and Red Hat has published an erratum (RHSA-2026:74503) to address the issue.
Authenticated users of Red Hat Satellite 6 (and upstream Foreman) running the foreman_remote_execution plugin can bypass the view_job_invocations permission filter and read other users' job invocation details - live output, rendered scripts, and input values - within their own organizations. The flaw is an incorrect authorization check in the template invocations controller, which resolves a job invocation purely by ID without verifying the caller's filtered visibility against that record, so an attacker with a low-privileged account can enumerate invocation IDs and harvest data they should not see. Rated CVSS 4.3 (low-to-moderate), it is read-only disclosure with no integrity or availability impact and is scoped to the attacker's own organization(s); no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Authenticated, low-privilege users in Foreman / Red Hat Satellite 6 that have the foreman_ansible plugin installed can bypass host-level visibility restrictions and pull the complete Ansible inventory - including host parameter values flagged as hidden - for hosts inside their own organization. The plugin's Ansible inventory API assembles its host list with an unscoped Host.where query, so the search filter attached to the caller's view_hosts permission is never applied, an incorrect-authorization (CWE-863) / IDOR-style defect. Rated CVSS 3.1 base 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue requires valid credentials and a deliberately narrowed view_hosts filter, is confidentiality-only with no write or cross-organization reach, and no public exploit code identified at time of analysis.
Authenticated users who hold the edit_ansible_variables permission in the Foreman foreman_ansible plugin (as shipped in Red Hat Satellite 6) can delete arbitrary Ansible override values by supplying a raw LookupValue record ID to the override-values destroy action, which performs no ownership or scope check. The flaw is an authorization/IDOR weakness rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with impact limited to integrity loss through deletion - notably, targets can include override values belonging to Ansible variables outside the caller's permission filter and overrides attached to Puppet smart class parameters. No public exploit code exists and there is no evidence of active exploitation (no CISA KEV listing), so practical risk is low-to-moderate and largely depends on how granularly the deployment's RBAC filters are configured.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Cross-organization IDOR in Katello's Content View Filter Rules API allows authenticated low-privileged users to access and modify filter rules belonging to Content View Filters in other organizations by supplying a foreign filter identifier. Red Hat Satellite 6 deployments running multi-organization configurations are affected, as the API enforces authorization on the Content View but fails to validate the parent Content View Filter's organizational boundary. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects the limited scope - authenticated access and Satellite's enterprise context constrain real-world exposure.
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across organizational and location boundaries due to missing object-level authorization (IDOR/BOLA, CWE-639). An authenticated user holding any template-related permission - as minimal as view_ptables - can retrieve audit-history revisions owned by other organizations simply by supplying a guessable audit ID. Template revisions may contain credentials, secrets, or sensitive configuration data, making the confidentiality impact high despite the low attack complexity. No public exploit has been identified at time of analysis, though the low-privilege entry bar lowers the practical exploitation threshold significantly.
Cross-organizational information disclosure in Katello - the content management engine of Red Hat Satellite 6 - allows any authenticated user to read lifecycle history of Content Views belonging to organizations other than their own. By supplying an arbitrary Content View identifier to the Content View History API endpoint, a low-privileged user bypasses organization-scope authorization and retrieves publication events, promotion history, associated usernames, and timestamps for foreign tenants. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; the CVSS 4.3 Medium rating reflects the strictly read-only, single-organization-boundary impact.
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included unredacted in diagnostic archives uploaded to console.redhat.com. The redaction layer uses a naive string-match on the literal key name 'password', leaving non-standard credential field names - such as those used by SSSD and Pacemaker - completely unprotected before archive upload. With CVSS PR:L, a threat actor with authenticated access to an organization's Red Hat Insights console can retrieve these cleartext credentials from stored archives. No public exploit identified at time of analysis and not confirmed in CISA KEV.
Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding host-edit permissions to retrieve sensitive infrastructure metadata from organizations and locations they are not authorized to access. The root cause is the taxonomy_scope controller method accepting organization and location IDs from nested request parameters without validating them against the caller's authorized tenancy scope, implementing a textbook CWE-639 authorization bypass through user-controlled key. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis; however, the low attack complexity and lack of user interaction make this straightforward to exploit for any low-privileged authenticated user in multi-tenant Satellite deployments.
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host-edit permissions to retarget an existing lookup value override to hosts outside their authorized organizational or location scope. The flaw stems from insufficient authorization enforcement on the match field when modified via nested host attributes, allowing an attacker to effectively write configuration overrides to managed hosts they are not permitted to administer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_keypairs' permission to bypass taxonomy scoping and retrieve private SSH keys belonging to foreign organizations by directly querying key pair IDs via the API. The flaw is an IDOR (CWE-639) at the multi-tenancy enforcement layer, meaning the isolation contract between tenant organizations is broken for any user granted that permission. No CISA KEV listing or public exploit code has been identified at time of analysis; impact is strictly confidentiality - no write or destructive capability is exposed through this path.
Server-Side Request Forgery (SSRF) in Foreman's HTTP proxy controller within Red Hat Satellite 6 allows high-privileged attackers to redirect internal HTTP requests to cloud metadata endpoints on AWS, GCP, and Azure environments. By manipulating HTTP parameters in the http_proxies_controller or http_proxy configuration files, an attacker can cause the Foreman server to issue forged requests to internal metadata services (e.g., AWS IMDS at 169.254.169.254), potentially harvesting IAM role credentials, access tokens, and environment configuration secrets. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the confidentiality impact is high given the value of cloud metadata credentials.
Cleartext credential persistence in foreman-mcp-server, a component of Red Hat Satellite 6, exposes session identifiers and authentication tokens through two independent logging paths. The INFO-level logger unconditionally records session identifiers (which function as authentication credentials) in plaintext, while a separate debug-mode logger incompletely sanitizes HTTP request headers, allowing Authorization tokens and API keys to persist in container logs. Any environment forwarding container logs to a centralized SIEM or log aggregation platform materially expands the attack surface beyond local disk access. No public exploit identified at time of analysis, and the CVE does not appear in CISA KEV.
Insufficient authorization in the Katello ContentUploadsController within Red Hat Satellite 6 permits authenticated users holding only the edit_products permission to query content metadata for repositories belonging to products they have no rights to manage. The flaw, rooted in a missing ActiveRecord scope on repository lookup, allows cross-product content-existence enumeration via the content-upload API - but explicitly does not permit modification, import, or publication of content. No public exploit exists and the vulnerability is not listed in CISA KEV; risk is bounded by the authentication requirement and the limited read-only impact.
SQL injection in the Katello plugin for Red Hat Satellite 6 allows authenticated remote attackers to execute arbitrary SQL commands via the sort_by parameter in the /api/hosts/bootc_images endpoint. An attacker can exploit this flaw to trigger database errors causing denial of service or conduct blind SQL injection attacks to extract sensitive information from the database. No patch is currently available for this vulnerability.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logic flaw in its central access control filter: when an API operation verifies multiple @Verify-annotated parameters, access is granted if any one of them is permitted rather than requiring permission on all of them. An authenticated attacker with a low-privilege account who legitimately can reach the first referenced object can therefore pass authorization checks on later parameters and, provided they know the victim resource identifiers, read consumer information or modify entitlements and subscription resources - including objects belonging to other organizations (CVSS 3.1: 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a valid account and prior knowledge of target consumer UUIDs, entitlement IDs, or subscription resource IDs, and is limited to endpoints that evaluate more than one verified parameter; no public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
OS command injection in the Foreman foreman-tail helper utility shipped with Red Hat Satellite 6.19 for RHEL 9 allows a local, authenticated user to execute arbitrary system commands with the privileges of whoever runs the tool, because unsanitized arguments are fed into an eval-based path-expansion string and shell metacharacters such as ;, & and | are interpreted as commands. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is strictly local-scope, so it only matters where a lower-privileged account on a Satellite/Foreman host can reach the utility and thereby escalate its privileges. There is no network-facing attack path, no public exploit code has been identified at time of analysis, and EPSS is low (0.55%, 44th percentile), though Red Hat has issued patched packages (for example 0:3.18.0.14-1.el9sat for Satellite 6.19 on RHEL 9) via several RHSA advisories.
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat: it is local-only, demands pre-existing delegated or privileged access to the rake tasks, and environments where only root invokes foreman-rake with no restricted sudo delegation are effectively not exposed; no public exploit code has been identified at time of analysis.
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can pull the kickstart provisioning template from Red Hat Satellite 6's /unattended/provision endpoint without supplying any token, provided a host is currently mid-provisioning and therefore has an unexpired token recorded in the Satellite database. The flaw is a semantic logic error in Foreman's host_verifier.rb: valid_host_token? validates database state rather than the token presented in the HTTP request, so the check passes even when the request carries no token. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), the exposure is gated by the provisioning window and yields information disclosure of the rendered template, not code execution; no public exploit code or active exploitation has been identified at time of analysis.
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman_remote_execution plugin, lets an authenticated Satellite user who holds job-template execution permissions run arbitrary shell commands on managed hosts. The injection only applies to job templates whose effective_user property is configured as overridable: true, in which case the user-supplied value is not sanitized before the Satellite server instantiates the job execution environment, so the payload executes during instantiation rather than through the template or playbook content itself. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), this requires an authenticated account (PR:L) and the non-default overridable setting, and no public exploit identified at time of analysis; Red Hat has published an erratum, RHSA-2026:74503.
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repository permissions to read arbitrary files accessible to the Pulp server process by submitting a crafted 'file:' URL through the 'file_url' parameter, which is dispatched to the file downloader despite an intended scheme check. Baseline impact is confidentiality loss on the Pulp host; in deployments that include Pulp Container the same flaw escalates to theft of the container registry token signing private key, enabling forged bearer tokens and unauthorized access to every private container repository in the registry. Downstream products embedding pulpcore are affected, including Red Hat Satellite 6, Red Hat Ansible Automation Platform 2, and Red Hat Update Infrastructure 4/5. There is no public exploit identified at time of analysis, and EPSS data was not provided; Red Hat tracks the issue under advisory https://access.redhat.com/security/cve/CVE-2026-90959.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. CVSS rates this 7.5 (High) with full confidentiality impact; no public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity unauthenticated network vector makes this a credible threat wherever RESTEasy-backed XML endpoints are exposed.
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-management permissions attach arbitrary roles - including the administrator role - to a user group and then enroll themselves, gaining full admin-level control. The Usergroup model fails to validate that the assigning user actually holds the roles being granted, breaking the RBAC delegation boundary. Rated CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and clear escalation path make it a strong patch priority.
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take over active administrative sessions by reusing leaked session IDs that the server caches without re-validating authentication tokens. Because session IDs are written to standard logs, any user with log read access can replay them to gain administrative control and pivot to infrastructure-wide code execution. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Command injection in Foreman's WebSocket proxy, as shipped in Red Hat Satellite 6, allows a malicious compute-resource provider to achieve remote code execution on the Satellite/Foreman server when a user opens a VM VNC console. The CVSS vector shows network access with no privileges (PR:N) but requires user interaction (UI:R), and practical exploitation depends on the attacker already controlling a registered compute resource that returns a crafted hostname; publicly available exploit code exists, while EPSS remains low at 0.12%.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Broken access control (CWE-863) in Foreman's domain and subnet interface API lets an authenticated user who already holds a host-view permission and can see a shared domain or subnet read interface records for hosts outside their authorized scope; the API checks the host permission but omits its search-limit filter, returning every interface on the domain or subnet. A user who also holds host-edit permission can persist a change to one of those out-of-scope interfaces, giving limited confidentiality and integrity impact (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Red Hat Satellite 6, which ships Foreman, is the affected product per CPE; no public exploit identified at time of analysis.
Authenticated users in Red Hat Satellite 6 (and the underlying Foreman permission-filter subsystem) can delete permission filters belonging to roles other than their own by abusing an API path that resolves filters by identifier without re-applying the caller's permission scope. The prerequisite is modest but not trivial: the attacker must already hold filter-delete rights for at least one role, and the victim roles must be unlocked - this is an insider or compromised semi-privileged account vector, not a default unauthenticated remote issue. Resulting impact is integrity-only (I:H, C:N/A:N) at CVSS 6.5, with other roles silently losing the access their deleted filters granted; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
An authorization flaw in Katello's Flatpak Remote Repositories API allows an authenticated user who is permitted to view flatpak remotes in one organization to retrieve flatpak remote repository records - including the stored credentials for that remote - belonging to a different organization. The same unscoped lookup is reused by the mirror action, so a user with edit rights on a product in their own organization can create a repository configured with another organization's flatpak remote URL and its stored remote credentials. Exploitation requires an authenticated account holding the flatpak-remote view permission, the flatpak remote feature to be in active use, and a multi-organization Red Hat Satellite 6 / Katello deployment; no public exploit code has been identified at time of analysis, and the flaw is a medium-priority authenticated authorization issue rather than an emergency.
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
Missing authentication in the smart_proxy_dynflow remote-execution callback handlers lets an unauthenticated network attacker forge progress and completion reports for a running job, causing the job to be recorded as a success or a failure with attacker-supplied output. The flaw (CWE-306) applies only when Red Hat Satellite 6 remote execution is configured in pull or pull-mqtt mode, and the attacker must already know the identifier of a live job and submit the forged report during that job's execution window, which is why the assessed severity is moderate (CVSS 5.9, AC:H, integrity-only). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Path traversal in pulp-rpm's distribution tree publishing allows an authenticated user with sync or upload privileges to write files outside the intended task work area on the Pulp server. Crafted addon or variant ids in a .treeinfo file are used as directory names without sanitization, enabling the creation of new directories and writing of repository metadata and packages as the Pulp worker user. This is an integrity-only issue with no data disclosure or service disruption; no public exploit has been identified, and the practical risk is lower than the base CVSS 5.0 suggests due to the required privileges and the create-only constraint.
Pulp Ansible's bearer-token refresh for collection remotes can disclose access tokens to an authenticated attacker who can create or sync a remote and point it at a malicious server. The attacker must then reuse the token at the issuing service, and exploitation is only possible if another token download for a different remote has run on the same worker process, meaning shared, multi-tenant deployments are primarily at risk. No public exploit code exists, and the assessed attack complexity is high (AC:H), so this is a moderate-priority information disclosure issue rather than a top-tier emergency.
Authenticated users with permission to create and sync container remotes in Pulp can obtain upstream registry credentials-usernames, passwords, or bearer tokens-stored for other remotes because the pulp-container worker reuses authentication material across sync operations. This affects deployments built on Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4/5, particularly multi-tenant environments where remotes share worker processes. No public exploit code or confirmed active exploitation has been identified; the flaw rates CVSS 6.5 (moderate) and requires no user interaction beyond the attacker's own sync, though it does require an authenticated user with remote-creation and sync privileges.
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. No public exploit identified at time of analysis; the vendor has released an errata (RHSA-2026:74503).
An authenticated low-privileged user can inject SQL through the Katello Registry Proxy in Red Hat Satellite 6 by placing a crafted label in the request path, allowing them to read arbitrary data from the Satellite database. The vulnerable code paths (check_blob_push_org_label and get_matching_products_from_org) interpolate request-supplied labels straight into raw SQL, and the only prerequisite is an account holding the create_personal_access_tokens permission - even a heavily restricted account with no Organization or Location assigned, which makes the effective privilege bar unusually low. Impact is limited to confidentiality (CVSS 6.5, C:H/I:N/A:N); no public exploit code has been identified at time of analysis, and Red Hat has published erratum RHSA-2026:74503 to address the flaw. This is a genuine but moderate-priority issue, not a critical drop-everything vulnerability.
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. Public exploit code and confirmed active exploitation are not indicated in the available intelligence, and Red Hat has published an erratum (RHSA-2026:74503) to address the issue.
Authenticated users of Red Hat Satellite 6 (and upstream Foreman) running the foreman_remote_execution plugin can bypass the view_job_invocations permission filter and read other users' job invocation details - live output, rendered scripts, and input values - within their own organizations. The flaw is an incorrect authorization check in the template invocations controller, which resolves a job invocation purely by ID without verifying the caller's filtered visibility against that record, so an attacker with a low-privileged account can enumerate invocation IDs and harvest data they should not see. Rated CVSS 4.3 (low-to-moderate), it is read-only disclosure with no integrity or availability impact and is scoped to the attacker's own organization(s); no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Authenticated, low-privilege users in Foreman / Red Hat Satellite 6 that have the foreman_ansible plugin installed can bypass host-level visibility restrictions and pull the complete Ansible inventory - including host parameter values flagged as hidden - for hosts inside their own organization. The plugin's Ansible inventory API assembles its host list with an unscoped Host.where query, so the search filter attached to the caller's view_hosts permission is never applied, an incorrect-authorization (CWE-863) / IDOR-style defect. Rated CVSS 3.1 base 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue requires valid credentials and a deliberately narrowed view_hosts filter, is confidentiality-only with no write or cross-organization reach, and no public exploit code identified at time of analysis.
Authenticated users who hold the edit_ansible_variables permission in the Foreman foreman_ansible plugin (as shipped in Red Hat Satellite 6) can delete arbitrary Ansible override values by supplying a raw LookupValue record ID to the override-values destroy action, which performs no ownership or scope check. The flaw is an authorization/IDOR weakness rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with impact limited to integrity loss through deletion - notably, targets can include override values belonging to Ansible variables outside the caller's permission filter and overrides attached to Puppet smart class parameters. No public exploit code exists and there is no evidence of active exploitation (no CISA KEV listing), so practical risk is low-to-moderate and largely depends on how granularly the deployment's RBAC filters are configured.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Cross-organization IDOR in Katello's Content View Filter Rules API allows authenticated low-privileged users to access and modify filter rules belonging to Content View Filters in other organizations by supplying a foreign filter identifier. Red Hat Satellite 6 deployments running multi-organization configurations are affected, as the API enforces authorization on the Content View but fails to validate the parent Content View Filter's organizational boundary. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects the limited scope - authenticated access and Satellite's enterprise context constrain real-world exposure.
Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across organizational and location boundaries due to missing object-level authorization (IDOR/BOLA, CWE-639). An authenticated user holding any template-related permission - as minimal as view_ptables - can retrieve audit-history revisions owned by other organizations simply by supplying a guessable audit ID. Template revisions may contain credentials, secrets, or sensitive configuration data, making the confidentiality impact high despite the low attack complexity. No public exploit has been identified at time of analysis, though the low-privilege entry bar lowers the practical exploitation threshold significantly.
Cross-organizational information disclosure in Katello - the content management engine of Red Hat Satellite 6 - allows any authenticated user to read lifecycle history of Content Views belonging to organizations other than their own. By supplying an arbitrary Content View identifier to the Content View History API endpoint, a low-privileged user bypasses organization-scope authorization and retrieves publication events, promotion history, associated usernames, and timestamps for foreign tenants. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; the CVSS 4.3 Medium rating reflects the strictly read-only, single-organization-boundary impact.
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included unredacted in diagnostic archives uploaded to console.redhat.com. The redaction layer uses a naive string-match on the literal key name 'password', leaving non-standard credential field names - such as those used by SSSD and Pacemaker - completely unprotected before archive upload. With CVSS PR:L, a threat actor with authenticated access to an organization's Red Hat Insights console can retrieve these cleartext credentials from stored archives. No public exploit identified at time of analysis and not confirmed in CISA KEV.
Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding host-edit permissions to retrieve sensitive infrastructure metadata from organizations and locations they are not authorized to access. The root cause is the taxonomy_scope controller method accepting organization and location IDs from nested request parameters without validating them against the caller's authorized tenancy scope, implementing a textbook CWE-639 authorization bypass through user-controlled key. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis; however, the low attack complexity and lack of user interaction make this straightforward to exploit for any low-privileged authenticated user in multi-tenant Satellite deployments.
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host-edit permissions to retarget an existing lookup value override to hosts outside their authorized organizational or location scope. The flaw stems from insufficient authorization enforcement on the match field when modified via nested host attributes, allowing an attacker to effectively write configuration overrides to managed hosts they are not permitted to administer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_keypairs' permission to bypass taxonomy scoping and retrieve private SSH keys belonging to foreign organizations by directly querying key pair IDs via the API. The flaw is an IDOR (CWE-639) at the multi-tenancy enforcement layer, meaning the isolation contract between tenant organizations is broken for any user granted that permission. No CISA KEV listing or public exploit code has been identified at time of analysis; impact is strictly confidentiality - no write or destructive capability is exposed through this path.
Server-Side Request Forgery (SSRF) in Foreman's HTTP proxy controller within Red Hat Satellite 6 allows high-privileged attackers to redirect internal HTTP requests to cloud metadata endpoints on AWS, GCP, and Azure environments. By manipulating HTTP parameters in the http_proxies_controller or http_proxy configuration files, an attacker can cause the Foreman server to issue forged requests to internal metadata services (e.g., AWS IMDS at 169.254.169.254), potentially harvesting IAM role credentials, access tokens, and environment configuration secrets. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the confidentiality impact is high given the value of cloud metadata credentials.
Cleartext credential persistence in foreman-mcp-server, a component of Red Hat Satellite 6, exposes session identifiers and authentication tokens through two independent logging paths. The INFO-level logger unconditionally records session identifiers (which function as authentication credentials) in plaintext, while a separate debug-mode logger incompletely sanitizes HTTP request headers, allowing Authorization tokens and API keys to persist in container logs. Any environment forwarding container logs to a centralized SIEM or log aggregation platform materially expands the attack surface beyond local disk access. No public exploit identified at time of analysis, and the CVE does not appear in CISA KEV.
Insufficient authorization in the Katello ContentUploadsController within Red Hat Satellite 6 permits authenticated users holding only the edit_products permission to query content metadata for repositories belonging to products they have no rights to manage. The flaw, rooted in a missing ActiveRecord scope on repository lookup, allows cross-product content-existence enumeration via the content-upload API - but explicitly does not permit modification, import, or publication of content. No public exploit exists and the vulnerability is not listed in CISA KEV; risk is bounded by the authentication requirement and the limited read-only impact.
SQL injection in the Katello plugin for Red Hat Satellite 6 allows authenticated remote attackers to execute arbitrary SQL commands via the sort_by parameter in the /api/hosts/bootc_images endpoint. An attacker can exploit this flaw to trigger database errors causing denial of service or conduct blind SQL injection attacks to extract sensitive information from the database. No patch is currently available for this vulnerability.