RHSA-2026:99952CriticalCVSS 9.6

Red Hat Security Advisory: Satellite 6.18.11 Async Update

Published
November 12, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (22)

CVE-2026-42784 →CVE-2026-68006 →CVE-2026-86324 →CVE-2026-107152 →CVE-2026-107360 →CVE-2026-61845 →CVE-2026-61847 →CVE-2026-86322 →CVE-2026-86323 →CVE-2026-102267 →CVE-2026-102273 →CVE-2026-81658 →CVE-2026-81668 →CVE-2026-102268 →CVE-2026-102272 →CVE-2026-103870 →CVE-2026-84503 →CVE-2026-90959 →CVE-2026-106471 →CVE-2026-107193 →CVE-2026-107443 →CVE-2026-111456 →

📋 Description

CVE-2026-42784 — sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-61845 — crass: crass: Denial of Service via crafted scientific notation in CSS CVE-2026-61847 — crass: crass: Denial of Service via excessive recursion when processing comments CVE-2026-68006 — puma: Puma: HTTP Request Smuggling via Underscore Header Name Confusion CVE-2026-81658 — foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup CVE-2026-81668 — rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup CVE-2026-84503 — ansible-core: ansible-core: ansible.builtin.git invokes git without a -- separator, allowing argument injection via a --leading repository URL (e.g. --upload-pack) -> RCE CVE-2026-86322 — foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController CVE-2026-86323 — foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController CVE-2026-86324 — foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController CVE-2026-90959 — pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-103870 — pulp-rpm: Distribution tree publish creates directories from .treeinfo ids CVE-2026-106471 — candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching CVE-2026-107152 — rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed CVE-2026-107193 — foreman: API filter lookup ignores a search-limited filter permission CVE-2026-107360 — rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions CVE-2026-107443 — foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix) CVE-2026-111456 — candlepin: Consumer certificate can register systems in another organization

🎯 Affected products53

  • Red Hat Satellite 6.18 for RHEL 9
  • ansible-core-1:2.16.19-4.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • ansible-core-1:2.16.19-4.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9
  • ansible-test-1:2.16.19-4.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • candlepin-0:4.6.7-2.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • candlepin-0:4.6.7-2.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9
  • candlepin-selinux-0:4.6.7-2.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-0:3.16.0.29-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-cli-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-debug-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-dynflow-sidekiq-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-ec2-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-journald-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-libvirt-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-openstack-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-pcp-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-postgresql-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-redis-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-service-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-telemetry-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • foreman-vmware-0:3.16.0.29-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pulp-container-0:2.24.16-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pulp-container-0:2.24.16-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pulp-rpm-0:3.29.12-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pulp-rpm-0:3.29.12-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pulpcore-0:3.73.45-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pulpcore-0:3.73.45-1.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pyjwt+crypto-0:2.15.1-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • python3.12-pyjwt-0:2.15.1-1.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9
  • +23 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: Syncing distribution trees only from a trusted upstream avoids a crafted .treeinfo from that source. An account that can upload a tree directly can still supply the file. Otherwise, Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Workaround: Exploitation requires knowledge of target resource identifiers (consumer UUIDs, entitlement IDs, pool IDs, or certificate serials), which are not normally visible across organizations. Restrict Candlepin REST API access to trusted administrators where feasible until a fixed candlepin build is deployed. Limit which principals can obtain consumer client certificates or manage activation keys. Workaround: Filter creation, update, and deletion are audited with the role. Review recent filter audit records for deletions and role changes by delegated filter administrators. Removing those two permissions from delegated roles, or leaving them unlimited and held only by fully trusted administrators, closes the path until a fix is available. Workaround: Restrict template edit privileges to trusted administrators until a fixed safemode release is deployed. Where feasible, avoid exposing highly privileged ActiveRecord objects to untrusted template authors. Workaround: Until a fix is deployed, remove view_hosts from untrusted users or block/restrict GET /api/v2/hosts/:id/template/:kind. Prefer granting only trusted administrators access that can view host provisioning output. Rotate host root credentials if Viewer-role users may have accessed this endpoint. Workaround: There is no configuration switch that stops a consumer certificate from calling registration while leaving normal consumer check-ins working. Restricting which clients can reach the Candlepin port limits who can attempt the call, and it does not stop a client that already has a valid consumer certificate and is allowed to use the API. Customers are advised to apply the relevant security updates when they become available.

🔗 References (32)