RHSA-2026:74506 - Security Advisory

Topic

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

Security Fix(es):

• python-dynaconf: Dynaconf: Arbitrary code execution via Server-Side Template Injection [rhn_satellite_6.16] (CVE-2026-33154)
• foreman: Excessive Permissions for Viewer Role on Preview [rhn_satellite_6.16] (CVE-2026-96659)
• foreman: Safemode Bypass leading to RCE [rhn_satellite_6.16] (CVE-2026-96658)
• satellite:el8/python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing [rhn_satellite_6.16] (CVE-2026-59893)
• python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing [rhn_satellite_6.16] (CVE-2026-59893)
• satellite:el8/python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing [rhn_satellite_6.16] (CVE-2026-54284)
• python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing [rhn_satellite_6.16] (CVE-2026-54284)
• satellite:el8/yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages [rhn_satellite_6.16] (CVE-2026-56862)
• satellite:el8/yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input [rhn_satellite_6.16] (CVE-2026-56858)
• satellite:el8/yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path resolution [rhn_satellite_6.16] (CVE-2026-56860)
• satellite:el8/yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [rhn_satellite_6.16] (CVE-2026-33818)
• satellite:el8/rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass [rhn_satellite_6.16] (CVE-2026-79654)
• python-gitpython: GitPython: Arbitrary file read via TagReference.create() [rhn_satellite_6.16] (CVE-2026-78679)
• python-gitpython: GitPython: Remote Code Execution via Git directory impersonation [rhn_satellite_6.16] (CVE-2026-87817)
• python-gitpython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)
• python-gitpython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks (CVE-2026-42215)
• python-gitpython: GitPython: Arbitrary File Overwrite via improper git option validation (CVE-2026-73624)
• python-gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620)
• python-gitpython: GitPython: Information disclosure via environment variable expansion in URL handling (CVE-2026-73622)
• python-gitpython: GitPython: Remote Code Execution via kwarg value smuggling (CVE-2026-73625)
• python-gitpython: GitPython: Remote Code Execution via malicious Git template (CVE-2026-73623)
• satellite-capsule:el8/python-lxml: lxml: URL bypass vulnerability in Cleaner via missing xlink:href [rhn_satellite_6.16] (CVE-2026-49825)
• yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhn_satellite_6.16] (CVE-2026-42504)
• yggdrasil-worker-forwarder: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
• satellite:el8/yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhn_satellite_6.16] (CVE-2026-42504)
• rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass [rhn_satellite_6.16] (CVE-2026-79654)
• yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [rhn_satellite_6.16] (CVE-2026-33818)
• yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages [rhn_satellite_6.16] (CVE-2026-56862)
• yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input [rhn_satellite_6.16] (CVE-2026-56858)
• yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path resolution [rhn_satellite_6.16] (CVE-2026-56860)
• satellite:el8/rubygem-katello: improper authorization logic allows resource enumeration [rhn_satellite_6.16] (CVE-2026-56098)
• rubygem-katello: improper authorization logic allows resource enumeration [rhn_satellite_6.16] (CVE-2026-56098)
• rubygem-katello: SQL injection in Registry Proxy via labels [rhn_satellite_6.16] (CVE-2026-56097)
• satellite:el8/rubygem-katello: SQL injection in Registry Proxy via labels [rhn_satellite_6.16] (CVE-2026-56097)
• satellite-utils:el8/rubygem-hammer_cli: command injection via insecure editor invocation [rhn_satellite_6.16] (CVE-2026-12545)
• rubygem-hammer_cli: command injection via insecure editor invocation [rhn_satellite_6.16] (CVE-2026-12545)
• foreman: SSTI and insecure deserialization in foreman-rake configuration [rhn_satellite_6.16] (CVE-2026-12544)
• satellite:el8/foreman: SSTI and insecure deserialization in foreman-rake configuration [rhn_satellite_6.16] (CVE-2026-12544)
• satellite:el8/foreman: command injection in foreman-tail [rhn_satellite_6.16] (CVE-2026-12542)
• foreman: command injection in foreman-tail [rhn_satellite_6.16] (CVE-2026-12542)
• satellite:el8/foreman: command injection in foreman-rake database tasks [rhn_satellite_6.16] (CVE-2026-12541)
• foreman: command injection in foreman-rake database tasks [rhn_satellite_6.16] (CVE-2026-12541)
• satellite:el8/foreman: command injection in foreman-rake errors:fetch_log via request_id parameter [rhn_satellite_6.16] (CVE-2026-12540)
• foreman: command injection in foreman-rake errors:fetch_log via request_id parameter [rhn_satellite_6.16] (CVE-2026-12540)
• satellite:el8/foreman: unauthenticated information disclosure via provisioning token validation flaw [rhn_satellite_6.16] (CVE-2026-12423)
• foreman: unauthenticated information disclosure via provisioning token validation flaw [rhn_satellite_6.16] (CVE-2026-12423)
• satellite:el8/rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter [rhn_satellite_6.16] (CVE-2026-12405)
• rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter [rhn_satellite_6.16] (CVE-2026-12405)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index

Release Notes:

Provisioning tokens are now required for all Operating System entries with Redhat family set. Attempts to download a unattended template without valid token will lead to “a provisioning token is required but a valid one was not provided” error.

This changed behavior will lead to inability to use Generic or Subnet Bootdisks, systems using this bootdiks will be not matched with the host entry and not boot. To use Bootdisk after applying the errata, either use Full Host Bootdisk which uses tokens, or set Administer - Settings - Provisioning - Installation token lifetime to zero. This turns off the token enforcement and allows unauthenticated parties to use arbitrary MAC addresses in unattended requests to fetch provisioning kickstart with possibly sensitive data.

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Satellite Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Extended Update Support 6.16 for RHEL 8 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 9 x86_64
• Red Hat Satellite Capsule Extended Update Support 6.16 for RHEL 8 x86_64

Fixes

• BZ - 2449774 - CVE-2026-33154 dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection
• BZ - 2467800 - CVE-2026-42284 GitPython: GitPython: Arbitrary code execution via improper validation of clone options
• BZ - 2467802 - CVE-2026-42215 GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
• BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
• BZ - 2488952 - CVE-2026-12405 rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
• BZ - 2488956 - CVE-2026-12423 foreman: unauthenticated information disclosure via provisioning token validation flaw
• BZ - 2489969 - CVE-2026-12540 foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
• BZ - 2489970 - CVE-2026-12541 foreman: command injection in foreman-rake database tasks
• BZ - 2489971 - CVE-2026-12542 foreman: command injection in foreman-tail
• BZ - 2489992 - CVE-2026-12544 foreman: SSTI and insecure deserialization in foreman-rake configuration
• BZ - 2489993 - CVE-2026-12545 rubygem-hammer_cli: command injection via insecure editor invocation
• BZ - 2490542 - CVE-2026-56098 rubygem-katello: improper authorization logic allows resource enumeration
• BZ - 2490543 - CVE-2026-56097 rubygem-katello: SQL injection in Registry Proxy via labels
• BZ - 2515243 - CVE-2026-73624 gitpython: GitPython: Arbitrary File Overwrite via improper git option validation
• BZ - 2515261 - CVE-2026-73620 gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding
• BZ - 2515269 - CVE-2026-73622 gitpython: GitPython: Information disclosure via environment variable expansion in URL handling
• BZ - 2515272 - CVE-2026-73625 gitpython: GitPython: Remote Code Execution via kwarg value smuggling
• BZ - 2515275 - CVE-2026-73623 gitpython: GitPython: Remote Code Execution via malicious Git template
• BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
• BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
• BZ - 2515827 - CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
• BZ - 2515838 - CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
• BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
• BZ - 2517523 - CVE-2026-59893 sqlparse: sqlparse: Denial of Service via inefficient SQL parsing
• BZ - 2517527 - CVE-2026-54284 sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing
• BZ - 2520368 - CVE-2026-49825 lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
• BZ - 2523205 - CVE-2026-78679 GitPython: GitPython: Arbitrary file read via TagReference.create()
• BZ - 2523348 - CVE-2026-79654 katello: Katello Content View History API Cross-Organization Authorization Bypass
• BZ - 2530744 - CVE-2026-87817 GitPython: GitPython: Remote Code Execution via Git directory impersonation
• BZ - 2534185 - CVE-2026-96658 foreman: Safemode Bypass leading to RCE
• BZ - 2536844 - CVE-2026-96659 foreman: Excessive Permissions for Viewer Role on Preview

CVEs

• CVE-2026-12405
• CVE-2026-12423
• CVE-2026-12540
• CVE-2026-12541
• CVE-2026-12542
• CVE-2026-12544
• CVE-2026-12545
• CVE-2026-33154
• CVE-2026-33818
• CVE-2026-42215
• CVE-2026-42284
• CVE-2026-42504
• CVE-2026-49825
• CVE-2026-54284
• CVE-2026-56097
• CVE-2026-56098
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-59893
• CVE-2026-73620
• CVE-2026-73622
• CVE-2026-73623
• CVE-2026-73624
• CVE-2026-73625
• CVE-2026-78679
• CVE-2026-79654
• CVE-2026-87817
• CVE-2026-96658
• CVE-2026-96659

References

• https://access.redhat.com/security/updates/classification/#critical