Satellite Capsule (Redhat) - vulnerabilities (CVEs)

64 CVEs, 11 in the last 30 days, 20 known versions, newest CVE from 2026-10-01. Vendor: Redhat.

CVEs of Satellite Capsule

CVE-2026-56098 - CVSS 4.3 (medium), 2026-10-01: A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through…
CVE-2026-56097 - CVSS 6.5 (medium), 2026-10-01: A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize…
CVE-2026-12542 - CVSS 7.8 (high), 2026-10-01: A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes…
CVE-2026-12545 - CVSS 6.7 (medium), 2026-10-01: A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with…
CVE-2026-96659 - CVSS 9.1 (critical), 2026-10-01: A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by…
CVE-2026-96658 - CVSS 8.8 (high), 2026-10-01: A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on…
CVE-2026-12544 - CVSS 7.7 (high), 2026-10-01: A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where…
CVE-2026-12541 - CVSS 8.2 (high), 2026-10-01: A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to…
CVE-2026-12540 - CVSS 8.2 (high), 2026-10-01: A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an…
CVE-2026-12423 - CVSS 7.5 (high), 2026-10-01: A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw…
CVE-2026-12405 - CVSS 8.8 (high), 2026-10-01: A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a…
CVE-2026-79654 - CVSS 4.3 (medium), 2026-08-26: A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An…
CVE-2026-16493 - CVSS 7.8 (high), 2026-07-21: A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands…
CVE-2026-12701 - CVSS 9 (critical), 2026-07-20: A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to…
CVE-2026-5138 - CVSS 4.3 (medium), 2026-07-01: A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw…
CVE-2026-5135 - CVSS 6.5 (medium), 2026-07-01: A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup…
CVE-2026-5142 - CVSS 6.5 (medium), 2026-07-01: A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure…
CVE-2026-5136 - CVSS 8.8 (high), 2026-07-01: A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an…
CVE-2026-54297 - CVSS 7.5 (high), 2026-06-24: Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3,…
CVE-2026-12515 - CVSS 4.3 (medium), 2026-06-17: A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController…
CVE-2026-11332 - CVSS 7.8 (high), 2026-06-05: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to…
CVE-2026-34993 - CVSS 7.3 (high), 2026-06-02: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may…
CVE-2026-48526 - CVSS 7.4 (high), 2026-05-28: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC…
CVE-2026-48864 - CVSS 7.8 (high), 2026-05-26: A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to…
CVE-2026-40192 - CVSS 8.7 (high), 2026-04-15: Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making…
CVE-2026-2332 - CVSS 9.1 (critical), 2026-04-14: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined…
CVE-2026-1961 - CVSS 8.8 (high), 2026-03-26: A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability…
CVE-2026-27459 - CVSS 9.8 (critical), 2026-03-18: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to…
CVE-2026-4324 - CVSS 5.4 (medium), 2026-03-17: A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote…
CVE-2025-69534 - CVSS 8.2 (high), 2026-03-05: Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError…
CVE-2025-10990 - CVSS 7.5 (high), 2026-02-27: A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references…
CVE-2026-0980 - CVSS 8.8 (high), 2026-02-27: A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host…
CVE-2025-9572 - CVSS 6.5 (medium), 2026-02-27: n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which…
CVE-2026-25990 - CVSS 8.6 (high), 2026-02-11: Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This…
CVE-2026-1287 - CVSS 8.3 (high), 2026-02-03: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via…
CVE-2026-1207 - CVSS 8.3 (high), 2026-02-03: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows…
CVE-2026-1312 - CVSS 8.5 (high), 2026-02-03: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases…
CVE-2026-1530 - CVSS 8.1 (high), 2026-02-02: A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate…
CVE-2026-1531 - CVSS 8.1 (high), 2026-02-02: A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA)…
CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
CVE-2025-10622 - CVSS 8 (high), 2025-11-05: A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary…
CVE-2024-6861 - CVSS 7.5 (high), 2024-11-06: A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to…
CVE-2024-8553 - CVSS 6.3 (medium), 2024-10-31: A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view…
CVE-2024-7012 - CVSS 9.8 (critical), 2024-09-04: An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration.…
CVE-2024-7923 - CVSS 9.8 (critical), 2024-09-04: An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore…
CVE-2024-4871 - CVSS 6.8 (medium), 2024-05-14: A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the…
CVE-2023-4320 - CVSS 7.6 (high), 2023-12-18: An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow…
CVE-2023-5189 - CVSS 6.5 (medium), 2023-11-14: A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer…
CVE-2023-4886 - CVSS 6.7 (medium), 2023-10-03: A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and…
CVE-2023-0118 - CVSS 9.1 (critical), 2023-09-20: An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the…
CVE-2023-0119 - CVSS 5.4 (medium), 2023-09-12: A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result…
CVE-2020-10716 - CVSS 6.5 (medium), 2021-05-27: A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious…
CVE-2020-10693 - CVSS 5.3 (medium), 2020-05-06: A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if…
CVE-2018-1000632 - CVSS 7.5 (high), 2018-08-20: dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an…
CVE-2016-8639 - CVSS 6.1 (medium), 2018-08-01: It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to…
CVE-2016-9595 - CVSS 7.3 (high), 2018-07-27: A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to…
CVE-2016-1000338 - CVSS 7.5 (high), 2018-06-01: In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject…
CVE-2018-10237 - CVSS 5.9 (medium), 2018-04-26: Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that…
CVE-2018-5382 - CVSS 4.4 (medium), 2018-04-16: The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle…
CVE-2017-2667 - CVSS 8.1 (high), 2018-03-12: Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a…
CVE-2017-15095 - CVSS 9.8 (critical), 2018-02-06: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code…
CVE-2017-7536 - CVSS 7 (high), 2018-01-10: In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to…
CVE-2017-15100 - CVSS 6.1 (medium), 2017-11-27: An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart"…
CVE-2017-5929 - CVSS 9.8 (critical), 2017-03-13: QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.