Loading story…
Red Hat released Important security updates for Red Hat Satellite that address six vulnerabilities in Satellite 6.17 and 6.18 deployments on RHEL 9. The advisories cover Red Hat Satellite 6.17.9.1 and Red Hat Satellite 6.18.7.1, along with affected Satellite Capsule packages, and remediate flaws in pulpcore and yggdrasil-worker-forwarder components used by the platform.
The fixed issues include an authorization bypass in gRPC-Go, multiple Go-related denial-of-service vulnerabilities, an IDNA/Punycode privilege-escalation issue, and a pulpcore directory traversal validator bypass. Red Hat said the updates affect Satellite 6.17 and 6.18 environments for x86_64 on RHEL 9, and one advisory also resolves an upgrade bug that could cause failures during migration from Satellite 6.16 to 6.17 with a pulpcore-manager rpm-datarepair CommandError.
See real exploitation activity before you spend the cycle.
15 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-04, Red Hat's Bugzilla tracked CVE-2026-12515, a Katello authorization flaw in ContentUploadsController that let a user with limited edit_products permissions query the /katello/api/v2/repositories/:id/content_uploads endpoint for repositories outside their authorized product scope, causing information disclosure. Red Hat said the issue was addressed in Satellite 6.16, 6.17, and 6.18 via RHSA-2026:50223, RHSA-2026:50222, and RHSA-2026:50263.
On 2026-08-04, Red Hat published RHSA-2026:50223, an Important security advisory for Red Hat Satellite 6.16 on RHEL 8 and RHEL 9. The update released Red Hat Satellite 6.16.12 Async Update and fixed multiple vulnerabilities in PyJWT, puppetserver/Jetty, Pillow, Faraday, Katello, Nokogiri, libsolv, and puppet-agent/OpenSSL, along with two bug fixes.
On 2026-08-04, Red Hat published RHSA-2026:50222, an Important security advisory for Red Hat Satellite 6.17 on RHEL 9. The update released Red Hat Satellite 6.17.10 and fixed multiple vulnerabilities in PyJWT, puppetserver/Jetty, Katello, OpenSSL, Pillow, Faraday, and Nokogiri, along with several Satellite bug fixes and a switch to OpenVox.
On 2026-08-04, Red Hat published RHSA-2026:50263, an Important async security advisory for Red Hat Satellite 6.18 on RHEL 9. The update released Red Hat Satellite 6.18.8 and fixed multiple vulnerabilities in puppetserver/Jetty, PyJWT, Katello, Faraday, Pillow, Nokogiri, and puppet-agent/OpenSSL, along with several non-security bug fixes.
On 2026-07-20, Red Hat published RHSA-2026:42151, an Important security advisory for Red Hat Satellite 6.18 for RHEL 9. The update released Red Hat Satellite 6.18.7.1 and fixed six vulnerabilities affecting yggdrasil-worker-forwarder and pulpcore.
On 2026-07-20, Red Hat published RHSA-2026:42150, an Important security advisory for Red Hat Satellite 6.17 for RHEL 9. The update released Red Hat Satellite 6.17.9.1 Async Update and fixed six vulnerabilities in pulpcore and yggdrasil-worker-forwarder, while also resolving upgrade bug SAT-47477.
On 2026-07-01, Red Hat's Bugzilla tracked CVE-2026-5136, a Foreman privilege escalation flaw in the Usergroup model that let an authenticated user with create_usergroups or edit_usergroups permissions assign arbitrary roles, including administrative roles, and add themselves to gain administrator-level access. Red Hat said the issue was addressed in Satellite 6.16, 6.17, and 6.18 via RHSA-2026:34367, RHSA-2026:34366, and RHSA-2026:34368.
On 2026-07-01, Red Hat's Bugzilla tracked CVE-2026-5142, a Foreman taxonomy scoping bypass in KeyPairsController#show that could let an authenticated user with view_keypairs permission download private SSH keys from other organizations. Red Hat said the issue affected multi-tenant Satellite deployments and was addressed in Satellite 6.16, 6.17, and 6.18 via RHSA-2026:34367, RHSA-2026:34366, and RHSA-2026:34368.
On 2026-07-01, Red Hat's Bugzilla tracked CVE-2026-5138, a Foreman cross-tenant information disclosure flaw caused by improper validation of nested taxonomy parameters. The issue could let an authenticated user with host creation or editing privileges access infrastructure metadata from unauthorized organizations or locations, and Red Hat said it was addressed in Satellite 6.16, 6.17, and 6.18 via RHSA-2026:34367, RHSA-2026:34366, and RHSA-2026:34368.
On 2026-07-01, Red Hat's Bugzilla tracked CVE-2026-5135, a broken access control flaw in Foreman that could let an authenticated user with host-edit permissions retarget lookup value overrides to other hosts and alter managed host configurations across organization and location boundaries. The record stated the issue was addressed in Red Hat Satellite 6.16, 6.17, and 6.18 via RHSA-2026:34367, RHSA-2026:34366, and RHSA-2026:34368.
On 2026-07-01, Red Hat published RHSA-2026:34368, an Important security advisory for Red Hat Satellite 6.18 on RHEL 9. The update released Red Hat Satellite 6.18.7 Async Update and fixed multiple vulnerabilities in Foreman, yggdrasil-worker-forwarder, and python-pillow, along with bug fix SAT-47204.
On 2026-07-01, Red Hat published RHSA-2026:34366, an Important security advisory for Red Hat Satellite 6.17 on RHEL 9. The update released Red Hat Satellite 6.17.9 and fixed multiple vulnerabilities in Foreman, python-pillow, dynflow-utils, and yggdrasil-worker-forwarder, along with two non-security bug fixes.
On 2026-06-18, Red Hat published RHSA-2026:27076, an Important security advisory for Red Hat Satellite 6.16 on RHEL 8 and RHEL 9. The update released Red Hat Satellite 6.16.9 Async Update, fixing multiple vulnerabilities in yggdrasil-worker-forwarder, dynflow-utils, python-pillow, and Go components, along with two Capsule-related bug fixes.
On 2026-06-15, Red Hat's Bugzilla tracked CVE-2026-48526, a PyJWT authentication bypass flaw affecting versions prior to 2.13.0 when verifiers accepted both asymmetric and HMAC algorithms. The record said improper validation of JSON Web Keys could let an attacker use the issuer's public key as an HMAC secret, and noted later fixes across products including Satellite 6.16, 6.17, and 6.18.
On 2026-03-06, Red Hat's Bugzilla received Bug 2445356 tracking CVE-2026-25679, a high-severity flaw in Go's net/url package involving incorrect parsing of IPv6 host literals and insufficient host/authority validation in url.Parse. The record linked the issue to broad downstream impact across Red Hat products, including Satellite 6.16, 6.17, and 6.18.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
17 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **important** asynchronous security updates for **Red Hat Satellite 6.16** and **6.17**, shipping Satellite `6.16.8` for RHEL 8 and 9 and Satellite `6.17.8` for RHEL 9. The advisories remediate five vulnerabilities in bundled components: `CVE-2026-25990` in Pillow, `CVE-2026-27727` in `mchange-commons-java` used by candlepin, `CVE-2025-69534` in `python-markdown`, `CVE-2026-27459` in `pyOpenSSL`, and `CVE-2026-33176` in Ruby **Active Support**. Affected products include Satellite, Satellite Capsule, and Extended Update Support variants for the supported RHEL releases. Red Hat also fixed several Satellite-specific security issues, including **cleartext proxy password exposure** in Virt-who Configuration, **certificate and key artifacts** left in the `rhsm` cache, and enforcement of **HTTPS-only** global registration. The Active Support flaw, `CVE-2026-33176`, could trigger denial of service because large scientific-notation strings such as `1e10000` cause `BigDecimal` to expand them into massive decimal values, consuming excessive memory and CPU; Red Hat said the issue was addressed in Satellite 6.16 and 6.17 through advisories `RHSA-2026:14874` and `RHSA-2026:14873`.
Aug 20, 2026
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform 2.5 and 2.6**, addressing a broad set of vulnerabilities across `ansible-core`, `automation-controller`, `automation-gateway`, `automation-platform-ui`, `pulpcore`, `urllib3`, `pip`, `receptor`, and multiple Go libraries. The advisories, **RHSA-2026:42078** and **RHSA-2026:42079**, cover issues ranging from arbitrary code execution and privilege escalation to denial of service, information disclosure, MITM and proxy-bypass conditions. Notable flaws include `CVE-2026-8643`, a `pip` wheel-installation path traversal bug that can overwrite files outside the intended directory; `CVE-2026-12701`, a `pulpcore` path traversal vulnerability that can let an authenticated administrator write files outside the export directory; and `CVE-2026-44432`, a `urllib3` decompression flaw that can drive excessive CPU and memory consumption. Red Hat also tied the updates to multiple **Go HTML parsing and certificate-handling vulnerabilities** affecting products in the platform stack. `CVE-2026-25681` and `CVE-2026-27136` in `golang.org/x/net/html` can let crafted HTML bypass sanitization and trigger **cross-site scripting**, with potential downstream code-execution impact in some application contexts, while `CVE-2026-27145` in Go's `crypto/x509` can cause quadratic CPU consumption during TLS hostname verification with a malicious certificate. Red Hat said fixes were issued across affected Ansible Automation Platform builds and related product variants, including Ansible Inside and Ansible Developer, and advised customers to apply the updated packages and follow platform release documentation for upgrade steps.
Aug 28, 2026