Red Hat Security Advisory: Satellite 6.19.6 Async Update

Fixed packages 74

Vulnerabilities 20

• Critical 9.6
  CVE-2026-107360 Public exploit

  Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions

  A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument method…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Critical 9.1
  CVE-2026-102268 Public exploit

  PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 8.9
  CVE-2026-61845

  Crass: Large numeric exponents cause CPU and memory denial of service

  Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use…

  rgrove crass crass ruby-crass Debian Ubuntu RubyGems
  Oct 30, 2026
• High 8.8
  CVE-2026-86322

  Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller

  A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• High 8.1
  CVE-2026-106471

  Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

  A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Oct 7, 2026
• High 8.1
  CVE-2026-90959

  Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

  A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a stri…

  Red Hat Red Hat Satellite 6 Red Hat Ansible Automation Platform 2 Red Hat Update Infrastructure 5
  Sep 24, 2026
• High 7.7
  CVE-2026-107443

  Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)

  A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete f…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• High 7.4
  CVE-2026-102267

  PyJWT: PyJWKClient follows redirects when fetching JWKS

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102272

  PyJWT BOM Bypass

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102273

  PyJWT accepts public JWK containers as HMAC secrets

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an app…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-42784

  Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

  A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the b…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Red Hat OpenShift Container Platform 4 Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 7.1
  CVE-2026-107152

  Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed

  An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts.…

  Red Hat Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• High 7.1
  CVE-2026-111456

  Candlepin: consumer certificate can register systems in another organization

  A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that aut…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Medium 6.3
  CVE-2026-61847

  Crass: A large number of adjacent CSS comments can trigger a SystemStackError

  Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An att…

  rgrove crass ruby-crass ruby-crass Debian Ubuntu RubyGems
  Oct 30, 2026
• Medium 5.4
  CVE-2026-81668

  Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

  A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and mo…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Aug 27, 2026
• Medium 5.0
  CVE-2026-103870

  Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

  A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write…

  Red Hat Red Hat Update Infrastructure 5 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Oct 7, 2026
• Medium 4.3
  CVE-2026-86323

  Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller

  A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(par…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Medium 4.3
  CVE-2026-86324

  Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller

  A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Medium 4.3
  CVE-2026-92893

  Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

  A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user wh…

  Red Hat Red Hat Satellite 6
  Sep 17, 2026
• Medium 4.3
  CVE-2026-92904

  Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check

  A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record.…

  Red Hat Red Hat Satellite 6
  Sep 17, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://issues.redhat.com/browse/SAT-48586
• article
  https://issues.redhat.com/browse/SAT-50692
• article
  https://issues.redhat.com/browse/SAT-52582
• article
  https://issues.redhat.com/browse/SAT-52583
• article
  https://issues.redhat.com/browse/SAT-52584
• article
  https://issues.redhat.com/browse/SAT-52585
• article
  https://issues.redhat.com/browse/SAT-52595
• article
  https://issues.redhat.com/browse/SAT-52698
• article
  https://issues.redhat.com/browse/SAT-53686
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_100120.json
• report
  https://access.redhat.com/security/cve/CVE-2026-42784
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42784
• report
  https://access.redhat.com/security/cve/CVE-2026-61845
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2564247
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-61845
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-61845
• article
  https://github.com/rgrove/crass/commit/ea6726b7f7cf7e85b23aa2240b8512b4f8d11ad9
• article
  https://github.com/rgrove/crass/releases/tag/v1.0.7
• article
  https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
• report
  https://access.redhat.com/security/cve/CVE-2026-61847
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2564254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-61847
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-61847
• article
  https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5
• article
  https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
• report
  https://access.redhat.com/security/cve/CVE-2026-81668
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524928
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-81668
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-81668
• report
  https://access.redhat.com/security/cve/CVE-2026-86322
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529289
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-86322
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-86322
• report
  https://access.redhat.com/security/cve/CVE-2026-86323
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-86323