Skip to contentRed Hat Satellite 6.18 vulnerabilities
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreForeman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontrollerCVE-2026-863244.3 Medium
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreForeman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontrollerCVE-2026-863234.3 Medium
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreForeman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontrollerCVE-2026-863228.8 High
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreCandlepin: consumer certificate can register systems in another organizationCVE-2026-1114567.1 High
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreForeman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)CVE-2026-1074437.7 High
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreRubygem-safemode: safemode: jail allow-list bypass via op-assign expressionsCVE-2026-107360Public exploit9.6 Critical
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreRubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signedCVE-2026-1071527.1 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +17 more +19 moreAnsible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rceCVE-2026-84503Fix available6.7 Medium
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +1 more +3 moreForeman: api filter lookup ignores a search-limited filter permissionCVE-2026-1071936.5 Medium
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +4 more +6 morePulp-rpm: distribution tree publish creates directories from .treeinfo idsCVE-2026-1038705.0 Medium
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreCandlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latchingCVE-2026-1064718.1 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-katello: improper authorization logic allows resource enumerationCVE-2026-560984.3 Medium
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-katello: sql injection in registry proxy via labelsCVE-2026-560976.5 Medium
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-hammer_cli: command injection via insecure editor invocationCVE-2026-125456.7 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: command injection in foreman-tailCVE-2026-125425.3 Medium
- theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 moreForeman: excessive permissions for viewer role on previewCVE-2026-966599.1 Critical
- theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 moreForeman: foreman: arbitrary code execution via safemode sandbox bypassCVE-2026-966588.8 High
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: ssti and insecure deserialization in foreman-rake configurationCVE-2026-125447.7 High
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: command injection in foreman-rake database tasksCVE-2026-125418.2 High
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: command injection in foreman-rake errors:fetch_log via request_id parameterCVE-2026-125408.2 High
- redhat satellite, theforeman foreman, red hat satellite 6 +5 more +7 moreForeman: unauthenticated information disclosure via provisioning token validation flawCVE-2026-124237.5 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterCVE-2026-124058.8 High
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +9 more +11 morePulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theftCVE-2026-909598.1 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookupCVE-2026-816685.4 Medium
- theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreForeman: cross-tenant disclosure of template revisions via unauthorized audit lookupCVE-2026-816586.5 Medium
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreKetello: katello content view history api cross-organization authorization bypassCVE-2026-796544.3 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +4 more +6 moreAnsible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)CVE-2026-16493Fix available7.8 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +10 more +12 morePulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCVE-2026-127019.0 Critical
- red hat confidential compute attestation, ansible automation platform 2, ansible automation platform 2.6 for rhel 9 +12 more +14 moreSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionCVE-2026-42784Fix available7.4 High
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: information disclosure via improper validation of nested request parametersCVE-2026-51384.3 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: unauthorized modification of host configurations via broken access controlCVE-2026-51356.5 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypassCVE-2026-51426.5 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulationCVE-2026-51368.8 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 moreForeman-mcp-server: mcp server: insecure sensitive http header sanitizationCVE-2026-90736.2 Medium
- theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 moreForeman-mcp-server: mcp server: active session hijacking via insecure session state reuseCVE-2026-121127.8 High
- faraday project faraday, red hat 3scale api management platform 2, satellite 6 +5 more +7 moreFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersCVE-2026-54297Fix available7.5 High
- red hat hardened images, satellite 6, satellite 6.16 for rhel 8 +4 more +6 moreKatello: missing repository authorization in content_uploads exposes cross-product content existenceCVE-2026-12515Fix available4.3 Medium
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +29 more +31 moreAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionCVE-2026-11332Fix available7.8 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 moreAIOHTTP Vulnerable to Deserialization of Untrusted DataCVE-2026-34993Fix available6.4 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedCVE-2026-48526Fix available7.4 High
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`CVE-2026-9277Public exploitFix available9.2 Critical
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 moreStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksCVE-2026-48710In KEVPublic exploitFix availableEPSS 70.3%6.5 Medium
- apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 moreApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`CVE-2026-44990Fix available9.3 Critical
- f5 nginx open source, nginx plus, dos +26 more +28 moreNGINX ngx_http_rewrite_module vulnerabilityCVE-2026-42945Public exploitFix availableEPSS 68.0%9.2 Critical
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039Fix available6.9 Medium
- Show moreLoading…