Red Hat Satellite 6 19 For Rhel 9
Monthly
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only low-level permissions to bypass the safemode sandbox in the provisioning/report templating engine and execute arbitrary commands on the management host, carrying a vendor score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is authenticated (CVSS vector PR:L) and requires the ability to author or render templates; the scope-changed impact is severe because a successful escape yields control of the Satellite/Foreman management server, not just the template context, but the prerequisite of valid credentials plus template privileges means the 9.9 rating overstates how easily the issue is reached in hardened deployments. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit template preview endpoints to disclose sensitive data, including host root passwords. In non-default configurations where Safemode protections are disabled, the flaw can escalate to arbitrary command execution as the Foreman system account. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 9.1 reflects high confidentiality impact, though the RCE component requires an insecure configuration.
Privileged local attackers who can control Foreman configuration data can chain server-side template injection with insecure deserialization through the foreman-rake initialization logic in /usr/share/foreman/config/settings.rb to execute arbitrary code on Red Hat Satellite 6.19 for RHEL 9 hosts, resulting in full host compromise and downstream supply chain risk. The assessed CVSS 3.1 vector (7.7, AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) confirms the attack is local and authenticated with high privileges plus a user-interaction component, so it is not remotely or unauthenticated reachable against a default deployment and real exposure is largely confined to compromised or malicious privileged operators. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Red Hat has published errata RHSA-2026:74503 addressing it.
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat: it is local-only, demands pre-existing delegated or privileged access to the rake tasks, and environments where only root invokes foreman-rake with no restricted sudo delegation are effectively not exposed; no public exploit code has been identified at time of analysis.
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can pull the kickstart provisioning template from Red Hat Satellite 6's /unattended/provision endpoint without supplying any token, provided a host is currently mid-provisioning and therefore has an unexpired token recorded in the Satellite database. The flaw is a semantic logic error in Foreman's host_verifier.rb: valid_host_token? validates database state rather than the token presented in the HTTP request, so the check passes even when the request carries no token. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), the exposure is gated by the provisioning window and yields information disclosure of the rendered template, not code execution; no public exploit code or active exploitation has been identified at time of analysis.
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman_remote_execution plugin, lets an authenticated Satellite user who holds job-template execution permissions run arbitrary shell commands on managed hosts. The injection only applies to job templates whose effective_user property is configured as overridable: true, in which case the user-supplied value is not sanitized before the Satellite server instantiates the job execution environment, so the payload executes during instantiation rather than through the template or playbook content itself. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), this requires an authenticated account (PR:L) and the non-default overridable setting, and no public exploit identified at time of analysis; Red Hat has published an erratum, RHSA-2026:74503.
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. No public exploit identified at time of analysis; the vendor has released an errata (RHSA-2026:74503).
An authenticated low-privileged user can inject SQL through the Katello Registry Proxy in Red Hat Satellite 6 by placing a crafted label in the request path, allowing them to read arbitrary data from the Satellite database. The vulnerable code paths (check_blob_push_org_label and get_matching_products_from_org) interpolate request-supplied labels straight into raw SQL, and the only prerequisite is an account holding the create_personal_access_tokens permission - even a heavily restricted account with no Organization or Location assigned, which makes the effective privilege bar unusually low. Impact is limited to confidentiality (CVSS 6.5, C:H/I:N/A:N); no public exploit code has been identified at time of analysis, and Red Hat has published erratum RHSA-2026:74503 to address the flaw. This is a genuine but moderate-priority issue, not a critical drop-everything vulnerability.
OS command injection in Foreman's foreman-tail utility, as shipped in Red Hat Satellite 6 (including Satellite 6.19 for RHEL 9), lets a local low-privileged user execute arbitrary shell commands by supplying arguments containing shell metacharacters such as ;, &, or |. Exploitation requires local access to a host running the affected Satellite/Foreman installation and the ability to invoke foreman-tail with attacker-controlled arguments (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 5.3); there is no remote or unauthenticated path, and the Unchanged scope with uniformly Low impacts indicates commands run at the invoking user's privilege rather than escalating. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Red Hat has published an errata addressing the flaw.
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. Public exploit code and confirmed active exploitation are not indicated in the available intelligence, and Red Hat has published an erratum (RHSA-2026:74503) to address the issue.
Authenticated remote code execution in Foreman and Red Hat Satellite 6.19 for RHEL 9 allows an attacker who holds only low-level permissions to bypass the safemode sandbox in the provisioning/report templating engine and execute arbitrary commands on the management host, carrying a vendor score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is authenticated (CVSS vector PR:L) and requires the ability to author or render templates; the scope-changed impact is severe because a successful escape yields control of the Satellite/Foreman management server, not just the template context, but the prerequisite of valid credentials plus template privileges means the 9.9 rating overstates how easily the issue is reached in hardened deployments. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated users with low-level Viewer permissions in Red Hat Satellite 6.19 (and upstream Foreman) can exploit template preview endpoints to disclose sensitive data, including host root passwords. In non-default configurations where Safemode protections are disabled, the flaw can escalate to arbitrary command execution as the Foreman system account. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 9.1 reflects high confidentiality impact, though the RCE component requires an insecure configuration.
Privileged local attackers who can control Foreman configuration data can chain server-side template injection with insecure deserialization through the foreman-rake initialization logic in /usr/share/foreman/config/settings.rb to execute arbitrary code on Red Hat Satellite 6.19 for RHEL 9 hosts, resulting in full host compromise and downstream supply chain risk. The assessed CVSS 3.1 vector (7.7, AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) confirms the attack is local and authenticated with high privileges plus a user-interaction component, so it is not remotely or unauthenticated reachable against a default deployment and real exposure is largely confined to compromised or malicious privileged operators. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Red Hat has published errata RHSA-2026:74503 addressing it.
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permission to execute those rake tasks - for example through a restricted sudo delegation - append arbitrary shell commands to the destination (backup) or file (import) parameter, achieving command execution with the privileges of the rake process and scoring CVSS 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The bug affects Foreman as shipped in Red Hat Satellite 6.19 for RHEL 9 and the broader Red Hat Satellite 6 line, and is tracked under CVE-2026-12541. This is a genuine but access-gated privilege-escalation risk rather than a mass-exploitable remote threat: it is local-only, demands pre-existing delegated or privileged access to the rake tasks, and environments where only root invokes foreman-rake with no restricted sudo delegation are effectively not exposed; no public exploit code has been identified at time of analysis.
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user who already holds a sudo grant for that specific rake task to break out of the intended grep invocation and run arbitrary commands with the privileges of the task. The request_id parameter reaches the underlying shell command without adequate metacharacter neutralization, so an attacker can inject ';', '"', or '|' and achieve command execution on the Satellite/Foreman host. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms this is a local, high-privilege-context privilege escalation rather than a remotely reachable flaw, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can pull the kickstart provisioning template from Red Hat Satellite 6's /unattended/provision endpoint without supplying any token, provided a host is currently mid-provisioning and therefore has an unexpired token recorded in the Satellite database. The flaw is a semantic logic error in Foreman's host_verifier.rb: valid_host_token? validates database state rather than the token presented in the HTTP request, so the check passes even when the request carries no token. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), the exposure is gated by the provisioning window and yields information disclosure of the rendered template, not code execution; no public exploit code or active exploitation has been identified at time of analysis.
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman_remote_execution plugin, lets an authenticated Satellite user who holds job-template execution permissions run arbitrary shell commands on managed hosts. The injection only applies to job templates whose effective_user property is configured as overridable: true, in which case the user-supplied value is not sanitized before the Satellite server instantiates the job execution environment, so the payload executes during instantiation rather than through the template or playbook content itself. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), this requires an authenticated account (PR:L) and the non-default overridable setting, and no public exploit identified at time of analysis; Red Hat has published an erratum, RHSA-2026:74503.
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. No public exploit identified at time of analysis; the vendor has released an errata (RHSA-2026:74503).
An authenticated low-privileged user can inject SQL through the Katello Registry Proxy in Red Hat Satellite 6 by placing a crafted label in the request path, allowing them to read arbitrary data from the Satellite database. The vulnerable code paths (check_blob_push_org_label and get_matching_products_from_org) interpolate request-supplied labels straight into raw SQL, and the only prerequisite is an account holding the create_personal_access_tokens permission - even a heavily restricted account with no Organization or Location assigned, which makes the effective privilege bar unusually low. Impact is limited to confidentiality (CVSS 6.5, C:H/I:N/A:N); no public exploit code has been identified at time of analysis, and Red Hat has published erratum RHSA-2026:74503 to address the flaw. This is a genuine but moderate-priority issue, not a critical drop-everything vulnerability.
OS command injection in Foreman's foreman-tail utility, as shipped in Red Hat Satellite 6 (including Satellite 6.19 for RHEL 9), lets a local low-privileged user execute arbitrary shell commands by supplying arguments containing shell metacharacters such as ;, &, or |. Exploitation requires local access to a host running the affected Satellite/Foreman installation and the ability to invoke foreman-tail with attacker-controlled arguments (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 5.3); there is no remote or unauthenticated path, and the Unchanged scope with uniformly Low impacts indicates commands run at the invoking user's privilege rather than escalating. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Red Hat has published an errata addressing the flaw.
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. Public exploit code and confirmed active exploitation are not indicated in the available intelligence, and Red Hat has published an erratum (RHSA-2026:74503) to address the issue.