RHSA-2026:22992LowCVSS 6.5
Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-48710 — starlette: Starlette: Security restriction bypass via malformed HTTP Host header
🎯 Affected products2
- Red Hat Satellite 6.19
- registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64 as a component of Red Hat Satellite 6.19
✅ Remediation
For Satellite MCP integration see the Red Hat Satellite documentation. Workaround: Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes. If custom middleware is present, it should be updated to use `request.scope["path"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:22992
- externalhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index
- externalhttps://access.redhat.com/security/cve/CVE-2026-48710
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://catalog.redhat.com/software/containers/search
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22992.json