Redhat Satellite vulnerabilities

• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-tail CVE-2026-12542 5.3 MediumOctober 1, 2026
• theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: excessive permissions for viewer role on preview CVE-2026-96659 9.1 CriticalOctober 1, 2026
• theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: foreman: arbitrary code execution via safemode sandbox bypass CVE-2026-96658 8.8 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: ssti and insecure deserialization in foreman-rake configuration CVE-2026-12544 7.7 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-rake database tasks CVE-2026-12541 8.2 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter CVE-2026-12540 8.2 HighOctober 1, 2026
• redhat satellite, theforeman foreman, red hat satellite 6 +5 more +7 more Foreman: unauthenticated information disclosure via provisioning token validation flaw CVE-2026-12423 7.5 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup CVE-2026-81658 6.5 MediumAugust 27, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: information disclosure via improper validation of nested request parameters CVE-2026-5138 4.3 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: unauthorized modification of host configurations via broken access control CVE-2026-5135 6.5 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass CVE-2026-5142 6.5 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation CVE-2026-5136 8.8 HighJuly 1, 2026
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config CVE-2026-13316 4.4 MediumJune 30, 2026
• theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 more Foreman-mcp-server: mcp server: insecure sensitive http header sanitization CVE-2026-9073 6.2 MediumJune 23, 2026
• theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 more Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse CVE-2026-12112 7.8 HighJune 23, 2026
• opensuse libsolv, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +37 more +39 more Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data CVE-2026-48864 Fix available 7.8 HighMay 26, 2026
• encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710 In KEVPublic exploitFix available EPSS 70.3% 6.5 MediumMay 22, 2026
• opensuse libsolv, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 more Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file CVE-2026-9149 Fix available 6.5 MediumMay 20, 2026
• opensuse libsolv, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 more Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums CVE-2026-9150 Fix available 6.5 MediumMay 20, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +4 more +6 more Forman: foreman: remote code execution via command injection in websocket proxy CVE-2026-1961 Public exploit 8.0 HighMarch 26, 2026
• immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 more Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVE-2026-29063 Fix available 8.7 HighMarch 4, 2026
• logicminds rubyipmi, redhat satellite, red hat satellite 6 +4 more +6 more Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username CVE-2026-0980 Fix available 8.3 HighFebruary 27, 2026
• redhat satellite, the foreman foreman, red hat satellite 6.15 for rhel 8 +6 more +8 more Foreman: satellite: graphql api permission bypass leads to information disclosure CVE-2025-9572 Fix available 5.0 MediumNovember 21, 2025
• redhat satellite, red hat satellite 6.13 for rhel 8, satellite 6.14 for rhel 8 +4 more +6 more Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore CVE-2024-7923 Fix available 9.8 CriticalSeptember 4, 2024
• redhat satellite, red hat satellite 6.13 for rhel 8, satellite 6.14 for rhel 8 +3 more +5 more Puppet-foreman: an authentication bypass vulnerability exists in foreman CVE-2024-7012 9.8 CriticalSeptember 4, 2024
• katello project katello, red hat satellite 6, redhat satellite +2 more Katello: potential cross-site scripting exploit in ui CVE-2024-4812 4.8 MediumJune 5, 2024
• red hat satellite 6, redhat satellite +1 more Foreman-installer: candlepin database password being leaked to local users via the process list CVE-2024-3716 6.2 MediumJune 5, 2024
• redhat satellite, red hat satellite 6.15 for rhel 8 +1 more Satellite: arithmetic overflow in satellite CVE-2023-4320 7.6 HighDecember 18, 2023
• red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, satellite 6.14 for rhel 8 +3 more +5 more Hub: insecure galaxy-importer tarfile extraction CVE-2023-5189 6.3 MediumNovember 14, 2023
• candlepinproject candlepin, red hat satellite 6, redhat satellite +2 more Improper authorization check in the server component CVE-2023-1832 6.8 MediumOctober 4, 2023
• theforeman foreman, red hat satellite 6.13 for rhel 8, satellite 6.14 for rhel 8 +1 more +3 more Foreman: world readable file containing secrets CVE-2023-4886 6.7 MediumOctober 3, 2023
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Os command injection via ct_command and fcct_command CVE-2022-3874 8.0 HighSeptember 22, 2023
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Arbitrary code execution through yaml global parameters CVE-2023-0462 8.0 HighSeptember 20, 2023
• theforeman foreman, red hat satellite 6.11 for rhel 7, satellite 6.11 for rhel 8 +4 more +6 more Foreman: arbitrary code execution through templates CVE-2023-0118 9.1 CriticalSeptember 20, 2023
• red hat satellite 6.13 for rhel 8, satellite 6.14 for rhel 8, redhat satellite +2 more Foreman: stored cross-site scripting in host tab CVE-2023-0119 Fix available 5.4 MediumSeptember 12, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• red hat satellite server, redhat satellite +1 more A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible... CVE-2022-4130 4.5 MediumDecember 16, 2022
• pulpproject pulp ansible, redhat ansible automation platform, satellite +1 more +3 more Plaintext storage of tokens in pulp_ansible CVE-2022-3644 Fix available 5.5 MediumOctober 25, 2022
• [unknown] satellite A flaw was found in satellite. When giving granular permission related to the organization, other... CVE-2021-3414 8.1 HighAugust 26, 2022
• the foreman foreman, redhat satellite +1 more A flaw was found in Foreman project. A credential leak was identified which will expose Azure... CVE-2021-3590 8.8 HighAugust 22, 2022
• theforeman foreman ansible, redhat satellite +1 more Missing Authentication for Critical Function in Foreman Ansible CVE-2021-3589 Fix available 8.0 HighMarch 23, 2022
• the foreman foreman, redhat satellite +1 more A server side remote code execution vulnerability was found in Foreman project. A authenticated... CVE-2021-3584 7.2 HighDecember 23, 2021
• qos logback, netapp cloud manager, service level manager +3 more +5 more RCE from attacker with configuration edit priviledges through JNDI lookup CVE-2021-42550 Fix available 6.6 MediumDecember 16, 2021
• djangoproject django, canonical ubuntu linux, debian linux +2 more +4 more Potential bypass of an upstream access control based on URL paths in Django CVE-2021-44420 Fix available 7.3 HighDecember 7, 2021
• red hat satellite An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with... CVE-2020-14380 Fix available 7.5 HighJune 2, 2021
• red hat satellite A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute... CVE-2020-14371 6.5 MediumJune 2, 2021
• red hat satellite A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets... CVE-2020-14335 5.5 MediumJune 2, 2021
• redhat satellite, satellite capsule, theforeman foreman ansible +2 more A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not... CVE-2020-10716 6.5 MediumMay 27, 2021
• [unknown] satellite, theforeman foreman azurerm +1 more A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A... CVE-2021-3413 6.3 MediumApril 8, 2021
• red hat satellite A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to... CVE-2021-20256 5.3 MediumFebruary 23, 2021
• Show olderLoading…