Loading story…
Red Hat released security updates for Satellite and Capsule deployments addressing vulnerabilities that could expose provisioning secrets or enable code execution across managed infrastructure. Advisories RHSA-2026:74504, RHSA-2026:74505, and RHSA-2026:74506 deliver Satellite 6.18.10, 6.17.12, and 6.16.14, respectively, fixing 23–24 CVEs per release. Key flaws include CVE-2026-12423, which lets unauthenticated attackers retrieve provisioning templates containing root password hashes, internal network details, and build tokens while hosts are being provisioned; CVE-2026-12405, which permits command injection by users with job-template execution permissions when the effective-user parameter is overridable; and CVE-2026-12540, which enables command injection through a log-fetch task available to users with specific sudo permissions. Separately, CVE-2026-96659, rated CVSS 9.1, allows low-privileged authenticated users to access sensitive host information through Foreman template previews, with potential code execution when Safemode protections are disabled or bypassed. Fixes for that flaw are available for Satellite 6.16, 6.18, and 6.19.
The updates also address a Foreman Safemode bypass, Dynaconf server-side template injection, and vulnerabilities across Katello, GitPython, Go components, and other dependencies. The three release advisories carry Critical headers, although their descriptive text rates the security impact Important; none reports active exploitation. Administrators should apply prerequisite errata and the appropriate security updates to affected Satellite Server and Capsule Server installations, review Viewer-role and job-execution permissions, keep Safemode enabled, and investigate suspicious template-preview activity. Satellite 6.16.14 introduces an operational change: unattended template downloads for Red Hat-family operating systems require valid provisioning tokens, disrupting Generic and Subnet Bootdisk workflows. Full Host Bootdisks support the tokens; disabling enforcement restores the alternative workflows but reopens unauthenticated access to potentially sensitive provisioning data.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:74506 for Satellite and Capsule 6.16 on RHEL 8 and RHEL 9, addressing 23 CVEs. The update requires valid tokens for unattended template downloads associated with Redhat-family operating systems, disrupting Generic and Subnet Bootdisk workflows; Full Host Bootdisks remain supported.
Red Hat issued RHSA-2026:74505 for Satellite and Capsule 6.17 on RHEL 9, addressing 24 CVEs. The update fixes code execution, command injection, authorization bypass, information disclosure, SQL injection, cross-site scripting, and denial-of-service vulnerabilities.
Red Hat issued RHSA-2026:74504 for Satellite and Capsule 6.18 on RHEL 9, addressing 23 CVEs across Foreman, Katello, GitPython, Dynaconf, and other components. Fixes include the Viewer-role information disclosure, provisioning-token authentication bypass, Safemode bypass, and multiple command injection vulnerabilities.
The authorization vulnerability allows authenticated users with the Viewer role to retrieve sensitive host attributes, potentially including root passwords. Red Hat rated it Important with a CVSS v3 score of 9.1; command execution may also be possible if template Safemode protections are disabled or circumvented.
OSIDB Bzimport recorded a command injection vulnerability in the foreman-rake errors:fetch_log task, where request_id is interpolated into a shell command. A user with sudo permission to execute the task could run arbitrary code as the foreman user, potentially compromising managed infrastructure.
OSIDB Bzimport recorded a Foreman authentication-bypass vulnerability that checks a stored provisioning token's expiration rather than validating a requester-supplied token. Unauthenticated attackers could retrieve provisioning templates containing root password hashes, internal network information, and active build tokens.
Red Hat released fixes for Satellite 6.19 on RHEL 9 under advisory RHSA-2026:74503. The fixes address the Foreman template-preview authorization weakness that can expose sensitive host information to low-privileged authenticated users.
Red Hat addressed CVE-2026-33154 in Ansible Automation Platform 2.6 for RHEL 9 through advisory RHSA-2026:34160. The vulnerability permits arbitrary code execution through server-side template injection in Dynaconf.
Dynaconf version 3.2.13 patches CVE-2026-33154, an arbitrary code execution vulnerability caused by unsafe template evaluation in its @Jinja resolver. Earlier versions evaluate configuration template expressions without a sandbox when jinja2 is installed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcedocs.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **important** asynchronous security updates for **Red Hat Satellite 6.16** and **6.17**, shipping Satellite `6.16.8` for RHEL 8 and 9 and Satellite `6.17.8` for RHEL 9. The advisories remediate five vulnerabilities in bundled components: `CVE-2026-25990` in Pillow, `CVE-2026-27727` in `mchange-commons-java` used by candlepin, `CVE-2025-69534` in `python-markdown`, `CVE-2026-27459` in `pyOpenSSL`, and `CVE-2026-33176` in Ruby **Active Support**. Affected products include Satellite, Satellite Capsule, and Extended Update Support variants for the supported RHEL releases. Red Hat also fixed several Satellite-specific security issues, including **cleartext proxy password exposure** in Virt-who Configuration, **certificate and key artifacts** left in the `rhsm` cache, and enforcement of **HTTPS-only** global registration. The Active Support flaw, `CVE-2026-33176`, could trigger denial of service because large scientific-notation strings such as `1e10000` cause `BigDecimal` to expand them into massive decimal values, consuming excessive memory and CPU; Red Hat said the issue was addressed in Satellite 6.16 and 6.17 through advisories `RHSA-2026:14874` and `RHSA-2026:14873`.
Aug 20, 2026
Red Hat released **Important** security updates for **Red Hat Satellite** that address six vulnerabilities in Satellite 6.17 and 6.18 deployments on RHEL 9. The advisories cover **Red Hat Satellite 6.17.9.1** and **Red Hat Satellite 6.18.7.1**, along with affected **Satellite Capsule** packages, and remediate flaws in `pulpcore` and `yggdrasil-worker-forwarder` components used by the platform. The fixed issues include an authorization bypass in **gRPC-Go**, multiple **Go**-related denial-of-service vulnerabilities, an **IDNA/Punycode** privilege-escalation issue, and a `pulpcore` directory traversal validator bypass. Red Hat said the updates affect Satellite 6.17 and 6.18 environments for `x86_64` on RHEL 9, and one advisory also resolves an upgrade bug that could cause failures during migration from Satellite 6.16 to 6.17 with a `pulpcore-manager rpm-datarepair` `CommandError`.
Aug 20, 2026
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform 2.5 and 2.6**, addressing a broad set of vulnerabilities across `ansible-core`, `automation-controller`, `automation-gateway`, `automation-platform-ui`, `pulpcore`, `urllib3`, `pip`, `receptor`, and multiple Go libraries. The advisories, **RHSA-2026:42078** and **RHSA-2026:42079**, cover issues ranging from arbitrary code execution and privilege escalation to denial of service, information disclosure, MITM and proxy-bypass conditions. Notable flaws include `CVE-2026-8643`, a `pip` wheel-installation path traversal bug that can overwrite files outside the intended directory; `CVE-2026-12701`, a `pulpcore` path traversal vulnerability that can let an authenticated administrator write files outside the export directory; and `CVE-2026-44432`, a `urllib3` decompression flaw that can drive excessive CPU and memory consumption. Red Hat also tied the updates to multiple **Go HTML parsing and certificate-handling vulnerabilities** affecting products in the platform stack. `CVE-2026-25681` and `CVE-2026-27136` in `golang.org/x/net/html` can let crafted HTML bypass sanitization and trigger **cross-site scripting**, with potential downstream code-execution impact in some application contexts, while `CVE-2026-27145` in Go's `crypto/x509` can cause quadratic CPU consumption during TLS hostname verification with a malicious certificate. Red Hat said fixes were issued across affected Ansible Automation Platform builds and related product variants, including Ansible Inside and Ansible Developer, and advised customers to apply the updated packages and follow platform release documentation for upgrade steps.
Aug 28, 2026