RHSA-2026:100120CriticalCVSS 9.6

Red Hat Security Advisory: Satellite 6.19.6 Async Update

Published
November 13, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (20)

CVE-2026-92893 →CVE-2026-92904 →CVE-2026-107152 →CVE-2026-81668 →CVE-2026-86324 →CVE-2026-103870 →CVE-2026-111456 →CVE-2026-42784 →CVE-2026-90959 →CVE-2026-102267 →CVE-2026-102273 →CVE-2026-106471 →CVE-2026-107360 →CVE-2026-107443 →CVE-2026-61847 →CVE-2026-86322 →CVE-2026-102268 →CVE-2026-102272 →CVE-2026-61845 →CVE-2026-86323 →

📋 Description

CVE-2026-42784 — sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-61845 — crass: crass: Denial of Service via crafted scientific notation in CSS CVE-2026-61847 — crass: crass: Denial of Service via excessive recursion when processing comments CVE-2026-81668 — rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup CVE-2026-86322 — foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController CVE-2026-86323 — foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController CVE-2026-86324 — foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController CVE-2026-90959 — pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft CVE-2026-92893 — rubygem-foreman_ansible: Ansible inventory API ignores view_hosts permission filters, exposes hidden parameters CVE-2026-92904 — rubygem-foreman_remote_execution: Job output readable without object-level view_job_invocations check CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-103870 — pulp-rpm: Distribution tree publish creates directories from .treeinfo ids CVE-2026-106471 — candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching CVE-2026-107152 — rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed CVE-2026-107360 — rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions CVE-2026-107443 — foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix) CVE-2026-111456 — candlepin: Consumer certificate can register systems in another organization

🎯 Affected products67

  • Red Hat Satellite 6.19 for RHEL 9
  • candlepin-0:4.7.7-2.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • candlepin-0:4.7.7-2.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • candlepin-selinux-0:4.7.7-2.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • createrepo_c-0:1.2.6-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • createrepo_c-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • createrepo_c-debuginfo-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • createrepo_c-debugsource-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • createrepo_c-libs-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • createrepo_c-libs-debuginfo-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-0:3.18.0.19-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-cli-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-debug-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-dynflow-sidekiq-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-ec2-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-journald-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-libvirt-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-openstack-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-pcp-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-postgresql-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-redis-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-service-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-telemetry-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • foreman-vmware-0:3.18.0.19-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-createrepo_c-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-createrepo_c-debuginfo-0:1.2.6-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pulp-container-0:2.26.19-2.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pulp-container-0:2.26.19-2.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9
  • python3.12-pulp-rpm-0:3.32.15-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9
  • +37 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: Restrict which users and roles have access to the view_hosts permission covering the ansible_inventories controller actions. If specific users do not need Ansible inventory access, remove the permission mapping from their roles. Review hidden parameter usage: avoid storing high-value credentials in host parameters that would be included in inventory output Workaround: Syncing distribution trees only from a trusted upstream avoids a crafted .treeinfo from that source. An account that can upload a tree directly can still supply the file. Otherwise, Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Workaround: Exploitation requires knowledge of target resource identifiers (consumer UUIDs, entitlement IDs, pool IDs, or certificate serials), which are not normally visible across organizations. Restrict Candlepin REST API access to trusted administrators where feasible until a fixed candlepin build is deployed. Limit which principals can obtain consumer client certificates or manage activation keys. Workaround: Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors. Workaround: Until a fix is deployed, remove view_hosts from untrusted users or block/restrict GET /api/v2/hosts/:id/template/:kind. Prefer granting only trusted administrators access that can view host provisioning output. Rotate host root credentials if Viewer-role users may have accessed this endpoint. Workaround: There is no configuration switch that stops a consumer certificate from calling registration while leaving normal consumer check-ins working. Restricting which clients can reach the Candlepin port limits who can attempt the call, and it does not stop a client that already has a valid consumer certificate and is allowed to use the API. Customers are advised to apply the relevant security updates when they become available.

🔗 References (12)