RHSA-2026:36350HighCVSS 8.5

Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

Published
July 7, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (6)

CVE-2026-48526 →CVE-2025-69196 →CVE-2025-69872 →CVE-2026-32871 →CVE-2026-44431 →CVE-2026-44432 →

📋 Description

CVE-2025-69196 — fastmcp: FastMCP: Improper token issuance due to incorrect resource parameter handling CVE-2025-69872 — python-diskcache: python-diskcache: Arbitrary code execution via insecure pickle deserialization CVE-2026-32871 — fastmcp: FastMCP: Authenticated Server-Side Request Forgery via path traversal in OpenAPI path parameters CVE-2026-44431 — urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44432 — urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-48526 — python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

🎯 Affected products2

  • Red Hat Satellite 6.18
  • registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:6dccc74936d6698a043e22a9f5ef42da0c4fc4ddb6feb903417ebf5627685138_amd64 as a component of Red Hat Satellite 6.18

✅ Remediation

For Satellite MCP integration see the Red Hat Satellite documentation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)