RHSA-2026:99952 - Security Advisory

Topic

A new release is now available for Red Hat Satellite 6.18 for RHEL 9.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

Security fix(es):

• rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup (CVE-2026-81668)
• sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)
• pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets (CVE-2026-102273)
• python3.12-pulp-rpm: Distribution tree publish creates directories from .treeinfo ids (CVE-2026-103870)
• candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching (CVE-2026-106471)
• pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
• pyjwt: Authentication bypass via improper public key validation (CVE-2026-102268)
• pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
• candlepin: Consumer certificate can register systems in another organization (CVE-2026-111456)
• foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup (CVE-2026-81658)
• foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController (CVE-2026-86322)
• foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController (CVE-2026-86323)
• foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController (CVE-2026-86324)
• foreman: API filter lookup ignores a search-limited filter permission (CVE-2026-107193)
• foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix) (CVE-2026-107443)
• safemode: Jail allow-list bypass via op-assign expressions (CVE-2026-107360)
• Puma: HTTP Request Smuggling via Underscore Header Name Confusion (CVE-2026-68006)
• rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed (CVE-2026-107152)
• crass: Denial of Service via crafted scientific notation in CSS (CVE-2026-61845)
• ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository URL (e.g. --upload-pack) -> RCE (CVE-2026-84503)
• crass: Denial of Service via excessive recursion when processing comments (CVE-2026-61847)
• pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft (CVE-2026-90959)

Bug fix(es):

• Adding hosts to a large host collection is slow (SAT-50731)
• Automatic Capsule sync is not triggered during subsequent Rolling Content View refreshes in Satellite 6.18 (SAT-50730)
• PG::SequenceGeneratorLimitExceeded: reached maximum value of sequence "katello_rpms_id_seq" during repo sync (SAT-53451)
• Recurring cookie store unavailable: :hash, error: key not found: :hash under bulk RHSM load (SAT-53458)
• Attempting to assign content-view-environments via hammer when LCE is not synced by content source should propagate error message text to hammer (SAT-53454)
• Client failed to register to the Satellite with "integer out of range" error (SAT-53455)
• Host::Managed audit exclusions not applied, resulting in excessive audit records (SAT-53456)
• RHSA-2026:74504: Token enforcement breaks generic non-PXE provisioning and fails when token_lifetime=0 (SAT-52738)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.18 x86_64
• Red Hat Satellite Capsule 6.18 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64

Fixes

• BZ - 2464122 - CVE-2026-42784 sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
• BZ - 2524899 - CVE-2026-81658 foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup
• BZ - 2524928 - CVE-2026-81668 rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup
• BZ - 2527098 - CVE-2026-84503 ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository URL (e.g. --upload-pack) -> RCE
• BZ - 2529289 - CVE-2026-86322 foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController
• BZ - 2529290 - CVE-2026-86323 foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController
• BZ - 2529291 - CVE-2026-86324 foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController
• BZ - 2531563 - CVE-2026-68006 puma: Puma: HTTP Request Smuggling via Underscore Header Name Confusion
• BZ - 2533037 - CVE-2026-90959 pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft
• BZ - 2542685 - CVE-2026-102268 pyjwt: PyJWT: Authentication bypass via improper public key validation
• BZ - 2542690 - CVE-2026-102267 pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects
• BZ - 2542695 - CVE-2026-102272 pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling
• BZ - 2542697 - CVE-2026-102273 pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets
• BZ - 2544606 - CVE-2026-103870 pulp-rpm: Distribution tree publish creates directories from .treeinfo ids
• BZ - 2547044 - CVE-2026-106471 candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching
• BZ - 2547374 - CVE-2026-107152 rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed
• BZ - 2547437 - CVE-2026-107193 foreman: API filter lookup ignores a search-limited filter permission
• BZ - 2547645 - CVE-2026-107360 rubygem-safemode: safemode: Jail allow-list bypass via op-assign expressions
• BZ - 2547760 - CVE-2026-107443 foreman: foreman: API host template render discloses secrets to view_hosts users (incomplete CVE-2026-96659 fix)
• BZ - 2553939 - CVE-2026-111456 candlepin: Consumer certificate can register systems in another organization
• BZ - 2564247 - CVE-2026-61845 crass: crass: Denial of Service via crafted scientific notation in CSS
• BZ - 2564254 - CVE-2026-61847 crass: crass: Denial of Service via excessive recursion when processing comments
• SAT-50730 - Automatic Capsule sync is not triggered during subsequent Rolling Content View refreshes in Satellite 6.18 [satellite_6.18]
• SAT-50731 - Adding hosts to a large host collection is slow [satellite_6.18]
• SAT-53451 - PG::SequenceGeneratorLimitExceeded: ERROR: nextval: reached maximum value of sequence "katello_rpms_id_seq" during repo sync [satellite_6.18]
• SAT-53454 - Attempting to assign content-view-environments via hammer when LCE is not synced by content source should propagate error message text to hammer [satellite_6.18]
• SAT-53455 - Client failed to register to the Satellite with "integer out of range" error [satellite_6.18]
• SAT-53456 - Host::Managed audit exclusions not applied, resulting in excessive audit records in Red Hat Satellite. [satellite_6.18]
• SAT-53458 - Recurring cookie store unavailable: :hash, error: key not found: :hash in Satellite under bulk RHSM load [satellite_6.18]

CVEs

• CVE-2026-42784
• CVE-2026-61845
• CVE-2026-61847
• CVE-2026-68006
• CVE-2026-81658
• CVE-2026-81668
• CVE-2026-84503
• CVE-2026-86322
• CVE-2026-86323
• CVE-2026-86324
• CVE-2026-90959
• CVE-2026-102267
• CVE-2026-102268
• CVE-2026-102272
• CVE-2026-102273
• CVE-2026-103870
• CVE-2026-106471
• CVE-2026-107152
• CVE-2026-107193
• CVE-2026-107360
• CVE-2026-107443
• CVE-2026-111456

References

• https://access.redhat.com/security/updates/classification/#critical