Proxy::Dynflow::Api selects authorizewithtoken from the path alone. If the Authorization header is absent, that method returns false and does not halt. A Sinatra before filter ignores the return value, so POST /dynflow/tasks/<uuid>/update and /done reach dispatchexternalevent. A second bypass sits in the same check: OtpManager.authenticate treats a Basic token with no colon as otp = nil, and passwords[username] == nil is true when that task has no stored OTP. generateotp has no production caller on current smartproxyremoteexecutionssh 1.0.x. On 0.11.x it is called only by PollingScriptRunner, and only in async-SSH mode. Omitting the header still bypasses that case.
This does not launch jobs. In the default :ssh mode, Runner::Base#externalevent refreshes and drops the payload. In :pull and :'pull-mqtt', PullScript#processexternalevent stores the caller’s output and exitcode, and exit code 0 is recorded as success.
On Satellite 6.16–6.18, async-SSH PollingScriptRunner#externalevent can also apply the payload when manualmode is set. That runner was removed in smartproxyremoteexecutionssh 1.0.0 (commit d8d1811, 2025-11-28).
The attacker must already know a live execution-plan UUID. Step ids are small integers. The console flaw below is what gives those UUIDs to a host that holds a CA-signed certificate.
Likely to be introduced in smartproxydynflow 0.4.0 by commit e205e19.
Description
The foreman-tail utility in Red Hat Satellite is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Impact
Successful exploitation allows a local attacker to escape restricted shells and execute arbitrary commands on the Satellite server. Consequently, the attacker could access sensitive information that could lead to remote code execution (RCE) and lateral movement across the managed infrastructure.
Recommendations
Refactor the script: Remove the use of eval. Use native shell array expansion or find to locate the necessary log files safely.
Input Validation: Implement a strict allow-list to ensure only valid service names are processed.
Description
A command injection vulnerability exists in the foreman-rake errors:fetchlog task within Red Hat Satellite. The requestid parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Impact
Successful exploitation allows a restricted user to escalate privileges to the foreman user and subsequently to root across all managed hosts, Organizations, and Locations. This represents a complete compromise of the Red Hat Satellite server and the entire infrastructure it manages.
Recommendations
Validate Input: Sanitize the requestid parameter to ensure it only contains alphanumeric characters and dashes, rejecting any input containing shell metacharacters.
Use Argument Arrays: Replace system calls that use shell string interpolation with array-based arguments to prevent shell interpretation (e.g., using Open3.capture3 with separate arguments in Ruby). Specifically, the following code in lib/tasks/errors.rake file should be replaced with something like this:
--------------------------------------------------------------------------------
// Vulnerable code
result = grep "#{requestid}" "#{filepath}"
Description
The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.
Because a host actively undergoing provisioning has an unexpired token in the database, the server's validhosttoken? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
--------------------------------------------------------------------------------
/usr/share/foreman/app/services/foreman/unattendedinstallation/hostverifier.rb
def validhosttoken?
return true unless @needstoken
return true unless forhosttemplate
VULNERABILITY: This only checks if the token in the database is currently expired.
It does NOT verify if the requester actually provided a valid token in the URL.
return true unless @host&.tokenexpired?
errors << { ... }
false
end
--------------------------------------------------------------------------------
Impact
By utilizing the enumeration technique detailed in F-26 Infrastructure Mapping via Observable Response Discrepancy, an unauthenticated remote attacker can actively poll the endpoint for a host entering a build state and extract its complete provisioning template. These templates contain highly sensitive data, including the root user's SHA-512 password hash, internal IP topography, and active API build tokens.
Description
A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/jobinvocations). When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input provided during the API request. Crucially, this exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.
Impact
An attacker with limited job execution privileges can gain full administrative control over managed hosts. By injecting malicious commands, they can bypass intended playbook restrictions, escalate privileges, and compromise the confidentiality, integrity, and availability of the entire managed infrastructure.
Recommendations
Implement strict input validation and white-listing for the effectiveuser parameter to ensure it only contains valid usernames and no shell metacharacters (e.g., ;, &, |, $).
Ensure the underlying execution engine uses safe API calls for user switching that do not involve shell evaluation of the username string.
End of life: 11/1/2027, End of support: 11/1/2026, Latest version: 6.19.5
End of life: 5/1/2027, End of support: 5/6/2026, Latest version: 6.18.10
A command injection flaw was found in Red Hat Satellite 6.16.5.2 (Foreman 3.12.0.8-1). Although a whitelist for CoreOS Transpiler Command and Fedora CoreOS Transpiler Command is implemented, the whitelist is only enforced on the client-side and is not validated on the server-side. This flaw allows an authenticated user with editsettings permissions to modify these parameters to achieve arbitrary command execution on underlying operating system and bypass safe mode rendering.
Important: Satellite 6.17.0 release
End of life: 11/30/2026, End of support: 11/30/2025, Latest version: 6.17.12
Important: Satellite 6.14.4.5 Async Update
Important: Satellite 6.15.5.2 Async Update
A flaw was found in Foreman / Red Hat Satellite, where temporary files created under /var/tmp during job execution have improper permissions. This allows low-privileged OS users to access and read command execution outputs, potentially exposing sensitive information such as system credentials or configuration details before the temporary files are deleted.This vulnerability does not grant direct privilege escalation but increases the risk of information disclosure, which could be leveraged in further attacks.
A flaw was found in Foreman / Red Hat Satellite, where temporary files created under /var/tmp during job execution have improper permissions. This allows low-privileged OS users to access and read command execution outputs, potentially exposing sensitive information such as system credentials or configuration details before the temporary files are deleted.This vulnerability does not grant direct privilege escalation but increases the risk of information disclosure, which could be leveraged in further attacks.
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed. The problem described was inteded behavior and therefore not a bug.
End of life: 11/30/2025, End of support: 11/30/2024, Latest version: 6.15.5.8
End of life: 11/30/2025, End of support: 11/30/2024, Latest version: 6.15.5.8
Moderate: Satellite 6.15.5 Async Update
End of life: 5/31/2026, End of support: 5/31/2025, Latest version: 6.16.10
End of life: 5/31/2026, End of support: 5/31/2025, Latest version: 6.16.10
Important: Satellite 6.15.4.2 Async Update
Moderate: Satellite 6.15.4 Security Update
An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 4.0+ and could potentially enable unauthorized users to gain administrative access.
An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 4.0+ and could potentially enable unauthorized users to gain administrative access.
A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.
An authentication bypass vulnerability exists in Foreman due to Pulpcore when deployed with Gunicorn versions earlier than 22.0. The issue arises from how Apache’s modproxy handles header as it fails to unset it properly due to restrictions on underscores in HTTP headers. This allow authentication through malformed header instead. This flaw affects all Katello/Satellite 6.10+ deployments using Pulpcore from version 4.0+ and could potentially allow unauthorized users to gain admin access.
When running a remote execution job on a host, the ssh key of the host is not being checked. When the key changes, the Satellite connects it anyway because it uses "-o StrictHostKeyChecking=no". This can lead to MITM, DoS, leaking of whatever secrets the remote execution job contains, or whatever other issues may arise from the attacker being able to forge a ssh key. This does not directly allow unauthorized remote execution on the Satellite (although it can leak secrets leading to it)..
For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.Security fixes: python-pygments: ReDoS in pygments (CVE-2022-40896) python-pycryptodomex: Side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) satellite: Arithmetic overflow in satellite (CVE-2023-4320) automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile extraction (CVE-2023-5189) jetty: Improper addition of quotation marks to user inputs in CgiServlet (CVE-2023-36479) python-aiohttp: HTTP request smuggling via llhttp HTTP request parser (CVE-2023-37276) rubygem-activesupport: File Disclosure of Locally Encrypted Files (CVE-2023-38037) jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167) python-django: Potential denial of service vulnerability in django.utils.encoding.uritoiri() (CVE-2023-41164) python-django: Denial-of-service possibility in django.utils.text.Truncator (CVE-2023-43665) python-aiohttp: Numerous issues in HTTP parser with header parsing (CVE-2023-47627) python-aiohttp: HTTP request modification (CVE-2023-49081) python-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client (CVE-2023-49082) rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding Bodies (CVE-2024-21647) rubygem-audited: Race condition can lead to audit logs being incorrectly attributed to the wrong user (CVE-2024-22047) python-jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195) python-aiohttp: Followsymlinks directory traversal vulnerability (CVE-2024-23334) python-aiohttp: HTTP request smuggling (CVE-2024-23829) Additional Changes:This update also fixes several bugs and adds various enhancements.Documentation for these changes is available from the Release Notes document linked to in the References section.
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.
Moderate: Satellite 6.14.3 Async Security Update