IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

satellite utils vulnerabilities (CVE)

CVE records published for satellite utils, newest first. Follow to get an email when a new one appears.

6.17 466.18 416.16 406.19 336.15 2
47 results
4.3Medium
CVE-2026-86324

Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the…

4.3Medium
CVE-2026-86323

Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(par…

8.8High
CVE-2026-86322

Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with…

7.1High
CVE-2026-111456

Candlepin: consumer certificate can register systems in another organization

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that aut…

7.7High
CVE-2026-107443

Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete f…

9.6Critical
CVE-2026-107360

Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument method…

7.1High
CVE-2026-107152

Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts.…

6.7Medium
CVE-2026-84503

Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce

Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9; Red Hat Migration Toolkit for Applications 8; Red Hat Migration Toolkit for Virtualization

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as…

6.5Medium
CVE-2026-107193

Foreman: api filter lookup ignores a search-limited filter permission

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete fi…

5.0Medium
CVE-2026-103870

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write…

8.1High
CVE-2026-106471

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can…

4.3Medium
CVE-2026-56098

Rubygem-katello: improper authorization logic allows resource enumeration

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers…

6.5Medium
CVE-2026-56097

Rubygem-katello: sql injection in registry proxy via labels

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blo…

6.7Medium
CVE-2026-12545

Rubygem-hammer_cli: command injection via insecure editor invocation

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() m…

5.3Medium
CVE-2026-12542

Foreman: command injection in foreman-tail

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expan…

9.1Critical
CVE-2026-96659

Foreman: excessive permissions for viewer role on preview

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sen…

8.8High
CVE-2026-96658

Foreman: foreman: arbitrary code execution via safemode sandbox bypass

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engi…

7.7High
CVE-2026-12544

Foreman: ssti and insecure deserialization in foreman-rake configuration

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution c…

8.2High
CVE-2026-12541

Foreman: command injection in foreman-rake database tasks

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (…

1.2%EPSS
8.2High
CVE-2026-12540

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is inten…

1.2%EPSS
7.5High
CVE-2026-12423

Foreman: unauthenticated information disclosure via provisioning token validation flaw

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than i…

8.8High
CVE-2026-12405

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to pr…

1.6%EPSS
8.1High
CVE-2026-90959

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a stri…

7.4High
CVE-2026-42784

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the b…

5.4Medium
CVE-2026-81668

Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

Red Hat Red Hat Satellite 6.16 for RHEL 8; Red Hat Red Hat Satellite 6.16 for RHEL 9; Red Hat Red Hat Satellite 6.17 for RHEL 9; Red Hat Red Hat Satellite 6.18 for RHEL 9

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and mo…