Detections
Analytics

RHEL 8 / 9 : Satellite 6.16.15 Async Update (Critical) (RHSA-2026:99949)

high Nessus Plugin ID 379924

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99949 advisory.

 Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.

 Security Fix(es):
 * sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784)
 * crass: Denial of Service via crafted scientific notation in CSS (CVE-2026-61845)
 * crass: Denial of Service via excessive recursion when processing comments (CVE-2026-61847)
 * Puma: HTTP Request Smuggling via Underscore Header Name Confusion (CVE-2026-68006)
 * foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup (CVE-2026-81658)
 * rubygem-katello: Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup (CVE-2026-81668)
 * foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController (CVE-2026-86322)
 * foreman: authorization flaw in the mail-notification endpoints implemented by Api::V2::MailNotificationsController (CVE-2026-86323)
 * foreman: authorization flaw in the Foreman::Controller::UserAware handling used by Api::V2::SshKeysController (CVE-2026-86324)
 * pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft (CVE-2026-90959)
 * pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
 * PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
 * pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
 * pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets (CVE-2026-102273)
 * python-pulp-rpm: Distribution tree publish creates directories from .treeinfo ids (CVE-2026-103870)
 * candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching (CVE-2026-106471)
 * rubygem-smart_proxy_dynflow: Dynflow console authorizes any client certificate the capsule CA signed (CVE-2026-107152)
 * foreman: API filter lookup ignores a search-limited filter permission (CVE-2026-107193)
 * safemode: Jail allow-list bypass via op-assign expressions (CVE-2026-107360)
 * foreman: API host template render discloses secrets to view_hosts users (CVE-2026-107443)
 * candlepin: Consumer certificate can register systems in another organization (CVE-2026-111456)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://access.redhat.com/errata/RHSA-2026:99949

https://access.redhat.com/security/updates/classification/#critical

https://bugzilla.redhat.com/show_bug.cgi?id=2464122

https://bugzilla.redhat.com/show_bug.cgi?id=2524899

https://bugzilla.redhat.com/show_bug.cgi?id=2524928

https://bugzilla.redhat.com/show_bug.cgi?id=2529289

https://bugzilla.redhat.com/show_bug.cgi?id=2529290

https://bugzilla.redhat.com/show_bug.cgi?id=2529291

https://bugzilla.redhat.com/show_bug.cgi?id=2531563

https://bugzilla.redhat.com/show_bug.cgi?id=2533037

https://bugzilla.redhat.com/show_bug.cgi?id=2542685

https://bugzilla.redhat.com/show_bug.cgi?id=2542690

https://bugzilla.redhat.com/show_bug.cgi?id=2542695

https://bugzilla.redhat.com/show_bug.cgi?id=2542697

https://bugzilla.redhat.com/show_bug.cgi?id=2544606

https://bugzilla.redhat.com/show_bug.cgi?id=2547044

https://bugzilla.redhat.com/show_bug.cgi?id=2547374

https://bugzilla.redhat.com/show_bug.cgi?id=2547437

https://bugzilla.redhat.com/show_bug.cgi?id=2547645

https://bugzilla.redhat.com/show_bug.cgi?id=2547760

https://bugzilla.redhat.com/show_bug.cgi?id=2553939

https://bugzilla.redhat.com/show_bug.cgi?id=2564247

https://bugzilla.redhat.com/show_bug.cgi?id=2564254

http://www.nessus.org/u?6e46c4d0

Plugin Details

Severity: High

ID: 379924

File Name: redhat-RHSA-2026-99949.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.1

Percentile: 98.16

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-102267

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.9

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CVSS Score Source: CVE-2026-61845

Vulnerability Information

CPE: cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:redhat:enterprise_linux:candlepin-selinux, p-cpe:/a:redhat:enterprise_linux:candlepin, p-cpe:/a:redhat:enterprise_linux:foreman-cli, p-cpe:/a:redhat:enterprise_linux:foreman-debug, p-cpe:/a:redhat:enterprise_linux:foreman-dynflow-sidekiq, p-cpe:/a:redhat:enterprise_linux:foreman-ec2, p-cpe:/a:redhat:enterprise_linux:foreman-journald, p-cpe:/a:redhat:enterprise_linux:foreman-libvirt, p-cpe:/a:redhat:enterprise_linux:foreman-openstack, p-cpe:/a:redhat:enterprise_linux:foreman-ovirt, p-cpe:/a:redhat:enterprise_linux:foreman-pcp, p-cpe:/a:redhat:enterprise_linux:foreman-postgresql, p-cpe:/a:redhat:enterprise_linux:foreman-redis, p-cpe:/a:redhat:enterprise_linux:foreman-service, p-cpe:/a:redhat:enterprise_linux:foreman-telemetry, p-cpe:/a:redhat:enterprise_linux:foreman-vmware, p-cpe:/a:redhat:enterprise_linux:foreman, p-cpe:/a:redhat:enterprise_linux:python-pulp-rpm, p-cpe:/a:redhat:enterprise_linux:python-pulpcore, p-cpe:/a:redhat:enterprise_linux:python-pyjwt, p-cpe:/a:redhat:enterprise_linux:python-pysequoia, p-cpe:/a:redhat:enterprise_linux:python3.11-pulp-rpm, p-cpe:/a:redhat:enterprise_linux:python3.11-pulpcore, p-cpe:/a:redhat:enterprise_linux:python3.11-pyjwt, p-cpe:/a:redhat:enterprise_linux:python3.11-pyjwt%2bcrypto, p-cpe:/a:redhat:enterprise_linux:python3.11-pysequoia, p-cpe:/a:redhat:enterprise_linux:rubygem-crass, p-cpe:/a:redhat:enterprise_linux:rubygem-katello, p-cpe:/a:redhat:enterprise_linux:rubygem-puma, p-cpe:/a:redhat:enterprise_linux:rubygem-safemode, p-cpe:/a:redhat:enterprise_linux:rubygem-smart_proxy_dynflow

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 5/11/2026

Reference Information

CVE: CVE-2026-102267, CVE-2026-102268, CVE-2026-102272, CVE-2026-102273, CVE-2026-103870, CVE-2026-106471, CVE-2026-107152, CVE-2026-107193, CVE-2026-107360, CVE-2026-107443, CVE-2026-111456, CVE-2026-42784, CVE-2026-61845, CVE-2026-61847, CVE-2026-68006, CVE-2026-81658, CVE-2026-81668, CVE-2026-86322, CVE-2026-86323, CVE-2026-86324, CVE-2026-90959

CWE: 183, 22, 287, 346, 347, 444, 639, 770, 862, 863

RHSA: 2026:99949