Proxy::Dynflow::Api selects authorizewithtoken from the path alone. If the Authorization header is absent, that method returns false and does not halt. A Sinatra before filter ignores the return value, so POST /dynflow/tasks/<uuid>/update and /done reach dispatchexternalevent. A second bypass sits in the same check: OtpManager.authenticate treats a Basic token with no colon as otp = nil, and passwords[username] == nil is true when that task has no stored OTP. generateotp has no production caller on current smartproxyremoteexecutionssh 1.0.x. On 0.11.x it is called only by PollingScriptRunner, and only in async-SSH mode. Omitting the header still bypasses that case.

This does not launch jobs. In the default :ssh mode, Runner::Base#externalevent refreshes and drops the payload. In :pull and :'pull-mqtt', PullScript#processexternalevent stores the caller’s output and exitcode, and exit code 0 is recorded as success.

On Satellite 6.16–6.18, async-SSH PollingScriptRunner#externalevent can also apply the payload when manualmode is set. That runner was removed in smartproxyremoteexecutionssh 1.0.0 (commit d8d1811, 2025-11-28).

The attacker must already know a live execution-plan UUID. Step ids are small integers. The console flaw below is what gives those UUIDs to a host that holds a CA-signed certificate.

Likely to be introduced in smartproxydynflow 0.4.0 by commit e205e19.

Description

The foreman-tail utility in Red Hat Satellite is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

Impact

Successful exploitation allows a local attacker to escape restricted shells and execute arbitrary commands on the Satellite server. Consequently, the attacker could access sensitive information that could lead to remote code execution (RCE) and lateral movement across the managed infrastructure.

Recommendations

Refactor the script: Remove the use of eval. Use native shell array expansion or find to locate the necessary log files safely.

Input Validation: Implement a strict allow-list to ensure only valid service names are processed.

Description

A command injection vulnerability exists in the foreman-rake errors:fetchlog task within Red Hat Satellite. The requestid parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.

Impact

Successful exploitation allows a restricted user to escalate privileges to the foreman user and subsequently to root across all managed hosts, Organizations, and Locations. This represents a complete compromise of the Red Hat Satellite server and the entire infrastructure it manages.

Recommendations

Validate Input: Sanitize the requestid parameter to ensure it only contains alphanumeric characters and dashes, rejecting any input containing shell metacharacters.

Use Argument Arrays: Replace system calls that use shell string interpolation with array-based arguments to prevent shell interpretation (e.g., using Open3.capture3 with separate arguments in Ruby). Specifically, the following code in lib/tasks/errors.rake file should be replaced with something like this:

--------------------------------------------------------------------------------

// Vulnerable code

result = grep "#{requestid}" "#{filepath}"

Description

A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/jobinvocations). When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input provided during the API request. Crucially, this exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.

Impact

An attacker with limited job execution privileges can gain full administrative control over managed hosts. By injecting malicious commands, they can bypass intended playbook restrictions, escalate privileges, and compromise the confidentiality, integrity, and availability of the entire managed infrastructure.

Recommendations

Implement strict input validation and white-listing for the effectiveuser parameter to ensure it only contains valid usernames and no shell metacharacters (e.g., ;, &, |, $).

Ensure the underlying execution engine uses safe API calls for user switching that do not involve shell evaluation of the username string.

Description

The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in hostverifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.

Because a host actively undergoing provisioning has an unexpired token in the database, the server's validhosttoken? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.

--------------------------------------------------------------------------------

/usr/share/foreman/app/services/foreman/unattendedinstallation/hostverifier.rb

def validhosttoken?

return true unless @needstoken

return true unless forhosttemplate

VULNERABILITY: This only checks if the token in the database is currently expired.

It does NOT verify if the requester actually provided a valid token in the URL.

return true unless @host&.tokenexpired?

errors << { ... }

false

end

--------------------------------------------------------------------------------

Impact

By utilizing the enumeration technique detailed in F-26 Infrastructure Mapping via Observable Response Discrepancy, an unauthenticated remote attacker can actively poll the endpoint for a host entering a build state and extract its complete provisioning template. These templates contain highly sensitive data, including the root user's SHA-512 password hash, internal IP topography, and active API build tokens.

A flaw was found in Foreman / Red Hat Satellite, where temporary files created under /var/tmp during job execution have improper permissions. This allows low-privileged OS users to access and read command execution outputs, potentially exposing sensitive information such as system credentials or configuration details before the temporary files are deleted.This vulnerability does not grant direct privilege escalation but increases the risk of information disclosure, which could be leveraged in further attacks.

End of life: 11/1/2027, End of support: 11/1/2026, Latest version: 6.19.5

When running a remote execution job on a host, the ssh key of the host is not being checked. When the key changes, the Satellite connects it anyway because it uses "-o StrictHostKeyChecking=no". This can lead to MITM, DoS, leaking of whatever secrets the remote execution job contains, or whatever other issues may arise from the attacker being able to forge a ssh key. This does not directly allow unauthorized remote execution on the Satellite (although it can leak secrets leading to it)..

Satellite is executing external requests via the Referer header under the /location/clear path. It is possible to trigger an external interaction to an attacker's server, by executing a GET request to /locations/clear and modifying the Referer header to an attacker-controlled server.

A command injection flaw was found in Red Hat Satellite 6.16.5.2 (Foreman 3.12.0.8-1). Although a whitelist for CoreOS Transpiler Command and Fedora CoreOS Transpiler Command is implemented, the whitelist is only enforced on the client-side and is not validated on the server-side. This flaw allows an authenticated user with editsettings permissions to modify these parameters to achieve arbitrary command execution on underlying operating system and bypass safe mode rendering.

A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.

An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 4.0+ and could potentially enable unauthorized users to gain administrative access.

An authentication bypass vulnerability exists in Foreman due to Pulpcore when deployed with Gunicorn versions earlier than 22.0. The issue arises from how Apache’s modproxy handles header as it fails to unset it properly due to restrictions on underscores in HTTP headers. This allow authentication through malformed header instead. This flaw affects all Katello/Satellite 6.10+ deployments using Pulpcore from version 4.0+ and could potentially allow unauthorized users to gain admin access.

End of life: 5/1/2027, End of support: 5/6/2026, Latest version: 6.18.10

An authentication bypass vulnerability has been identified in Foreman when deployed with Gunicorn versions prior to 22.0, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 4.0+ and could potentially enable unauthorized users to gain administrative access.

Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed. The problem described was inteded behavior and therefore not a bug.

Oracle Java SE 8u161 and 9.0.4 fixes an unspecified vulnerability in the Installer component (CVE-2018-2627). Upstream has CVSS scored this issue as: 7.5/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

External Reference:

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA

Important: Satellite 6.17.0 release

End of life: 11/30/2026, End of support: 11/30/2025, Latest version: 6.17.12

Important: Satellite 6.14.4.5 Async Update

Important: Satellite 6.15.5.2 Async Update

A flaw was found in Foreman / Red Hat Satellite, where temporary files created under /var/tmp during job execution have improper permissions. This allows low-privileged OS users to access and read command execution outputs, potentially exposing sensitive information such as system credentials or configuration details before the temporary files are deleted.This vulnerability does not grant direct privilege escalation but increases the risk of information disclosure, which could be leveraged in further attacks.

End of life: 11/30/2025, End of support: 11/30/2024, Latest version: 6.15.5.8

End of life: 11/30/2025, End of support: 11/30/2024, Latest version: 6.15.5.8

Moderate: Satellite 6.15.5 Async Update

HTTP requests for URLs with trailing newlines could bypass an upstream access control based on URL paths.

A vulnerability was found in the way Satellite 6 installer logs the calls to Candlepins cpdb. The /var/log/candlepin/cpdb.log log file permissions allows a non privileged user to read credentials information from the log files.

Bug report: https://bugzilla.redhat.com/showbug.cgi?id=1692703

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

Oracle Java SE 8u201 fixes an unspecified vulnerability in the Deployment component (CVE-2019-2449). Upstream has CVSS scored this issue as: 3.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

External Reference:

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixJAVA