Red Hat Security Advisory: Satellite 6.16.15 Async Update

Fixed packages 96

Vulnerabilities 21

• Critical 9.6
  CVE-2026-107360 Public exploit

  Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions

  A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument method…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Critical 9.1
  CVE-2026-102268 Public exploit

  PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• Critical 9.1
  CVE-2026-68006

  An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11…

  puma puma Debian Ubuntu
  Sep 10, 2026
• High 8.9
  CVE-2026-61845

  Crass: Large numeric exponents cause CPU and memory denial of service

  Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use…

  rgrove crass crass ruby-crass Debian Ubuntu RubyGems
  Oct 30, 2026
• High 8.8
  CVE-2026-86322

  Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller

  A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• High 8.1
  CVE-2026-106471

  Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

  A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can…

  Red Hat Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9
  Oct 7, 2026
• High 8.1
  CVE-2026-90959

  Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

  A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a stri…

  Red Hat Red Hat Satellite 6 Red Hat Ansible Automation Platform 2 Red Hat Update Infrastructure 5
  Sep 24, 2026
• High 7.7
  CVE-2026-107443

  Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)

  A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete f…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• High 7.4
  CVE-2026-102267

  PyJWT: PyJWKClient follows redirects when fetching JWKS

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102272

  PyJWT BOM Bypass

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102273

  PyJWT accepts public JWK containers as HMAC secrets

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an app…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-42784

  Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

  A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the b…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Red Hat OpenShift Container Platform 4 Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 7.1
  CVE-2026-107152

  Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed

  An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts.…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• High 7.1
  CVE-2026-111456

  Candlepin: consumer certificate can register systems in another organization

  A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that aut…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Medium 6.5
  CVE-2026-107193

  Foreman: api filter lookup ignores a search-limited filter permission

  A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete fi…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Oct 12, 2026
• Medium 6.5
  CVE-2026-81658

  Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

  A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain hi…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Aug 27, 2026
• Medium 6.3
  CVE-2026-61847

  Crass: A large number of adjacent CSS comments can trigger a SystemStackError

  Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An att…

  rgrove crass crass ruby-crass Debian Ubuntu RubyGems
  Oct 30, 2026
• Medium 5.4
  CVE-2026-81668

  Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

  A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and mo…

  Red Hat Red Hat Satellite 6 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Aug 27, 2026
• Medium 5.0
  CVE-2026-103870

  Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

  A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write…

  Red Hat Red Hat Update Infrastructure 5 Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9
  Oct 7, 2026
• Medium 4.3
  CVE-2026-86323

  Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller

  A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(par…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026
• Medium 4.3
  CVE-2026-86324

  Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller

  A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the…

  Red Hat Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.17 for RHEL 9 Red Hat Satellite 6.16 for RHEL 9
  Nov 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464122
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524899
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524928
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529289
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542690
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542695
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2544606
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547044
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2547760
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2553939
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2564247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2564254
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99949.json
• report
  https://access.redhat.com/security/cve/CVE-2026-42784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42784
• report
  https://access.redhat.com/security/cve/CVE-2026-61845
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-61845
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-61845
• article
  https://github.com/rgrove/crass/commit/ea6726b7f7cf7e85b23aa2240b8512b4f8d11ad9
• article
  https://github.com/rgrove/crass/releases/tag/v1.0.7
• article
  https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
• report
  https://access.redhat.com/security/cve/CVE-2026-61847
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-61847
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-61847
• article
  https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5
• article
  https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
• report
  https://access.redhat.com/security/cve/CVE-2026-68006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68006