RHSA-2026:22993HighCVSS 8.1

Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

Published
June 3, 2026
Last Modified
August 9, 2026

🔗 CVE IDs covered (4)

CVE-2025-62727 →CVE-2026-26007 →CVE-2026-34444 →CVE-2026-48710 →

📋 Description

CVE-2025-62727 — starlette: Starlette DoS via Range header merging CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-34444 — lupa: Lupa: Arbitrary Code Execution due to inconsistent attribute filtering CVE-2026-48710 — starlette: Starlette: Security restriction bypass via malformed HTTP Host header

🎯 Affected products2

  • Red Hat Satellite 6.18
  • registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64 as a component of Red Hat Satellite 6.18

✅ Remediation

For Satellite MCP integration see the Red Hat Satellite documentation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes. If custom middleware is present, it should be updated to use `request.scope["path"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.

🔗 References (9)