RHSA-2026:100120 - Security Advisory

Topic

A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red
Hat Product Security has rated this update as having a security impact of
Critical.

Description

This advisory provides security fixes for affected packages used by Red Hat
Satellite.
The updates address the vulnerabilities described below.

Security Fix(es):

• python3.12-pyjwt: Fixes token verification, authentication-bypass, and

token-forgery vulnerabilities (CVE-2026-102267, CVE-2026-102268,
CVE-2026-102272, CVE-2026-102273).

• rubygem-smart_proxy_dynflow: Restricts authorization of Dynflow console

clients to permitted client certificates (CVE-2026-107152).

• rubygem-safemode: Fixes a jail allow-list bypass (CVE-2026-107360).
• foreman: Fixes authorization flaws in personal access token, mail

notification, SSH key, and host template endpoints (CVE-2026-107443,
CVE-2026-86322, CVE-2026-86323, CVE-2026-86324).

• candlepin: Prevents consumer certificates from registering systems in

another organization (CVE-2026-111456).

• rubygem-crass: Fixes denial-of-service conditions in CSS processing

(CVE-2026-61845, CVE-2026-61847).

• python3.12-pulpcore: Restricts file URL content uploads to prevent

arbitrary file reads (CVE-2026-90959).

• rubygem-foreman_ansible: Enforces authorization when accessing Ansible

inventory data (CVE-2026-92893).

• rubygem-foreman_remote_execution: Enforces object-level authorization for

job output (CVE-2026-92904).

• rubygem-katello: Fixes cross-tenant access and modification of Content

View Filter rules (CVE-2026-81668).

• python3.12-pysequoia: Fixes cryptographic integrity compromise caused by

key flag confusion (CVE-2026-42784).

• python3.12-pulp-rpm: Prevents distribution tree publishing from creating

directories based on .treeinfo IDs (CVE-2026-103870).

• candlepin: Fixes an authorization bypass caused by multiple @Verify

hasAccess checks (CVE-2026-106471).

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions, refer to:
https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index

Affected Products

• Red Hat Satellite 6.19 x86_64
• Red Hat Satellite Capsule 6.19 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64

Fixes

• SAT-50692 - TagsAuth#update_tag fires a synchronous, uncached POST /tags on every forwarded UI request, causing duplicate work per page load
• SAT-52584 - Recurring cookie store unavailable: :hash, error: key not found: :hash in Satellite under bulk RHSM load
• SAT-48586 - WebUI Inventory Upload: link to Documentation is broken
• SAT-52582 - Attempting to assign content-view-environments via hammer when LCE is not synced by content source should propagate error message text to hammer
• SAT-52583 - Host::Managed audit exclusions not applied, resulting in excessive audit records in Red Hat Satellite.
• SAT-52585 - Client failed to register to the Satellite with "integer out of range" error
• SAT-52595 - Token endpoint crashes with NotNullConstraintViolation for clients that omit the `account` query parameter
• SAT-52698 - RHSA-2026:74504: Token enforcement breaks generic non-PXE provisioning and fails when token_lifetime=0 (6.19)
• SAT-53686 - Red Hat Enterprise Linux 9 for x86_64 - AppStream RPMs 9 sync fails with duplicate key value error

CVEs

• CVE-2026-42784
• CVE-2026-61845
• CVE-2026-61847
• CVE-2026-81668
• CVE-2026-86322
• CVE-2026-86323
• CVE-2026-86324
• CVE-2026-90959
• CVE-2026-92893
• CVE-2026-92904
• CVE-2026-102267
• CVE-2026-102268
• CVE-2026-102272
• CVE-2026-102273
• CVE-2026-103870
• CVE-2026-106471
• CVE-2026-107152
• CVE-2026-107360
• CVE-2026-107443
• CVE-2026-111456

References

• https://access.redhat.com/security/updates/classification/#critical