CVE-2024-4871VulnerabilityPublished 14 May 2024Updated 25 Feb 2026

CVE-2024-4871: satellite · Key Exchange without Entity Authentication

Affects satelliteSource CVE Database V5

Not known to be exploited · CVSS 6.8 Medium.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

6.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 May 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hatredhat/satellite`pkg:rpm/redhat/satellite`Other threats	Affected =3.9.1.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

To mitigate CVE-2024-4871, organizations should first upgrade Satellite to a version where this vulnerability is patched or addressed by the vendor. If an immediate upgrade is not feasible, administrators should manually enforce strict SSH host key verification by removing or overriding the '-o StrictHostKeyChecking=no' option in remote execution job configurations. This can be achieved by customizing SSH client options or scripts used by Satellite to ensure that host keys are validated against known fingerprints before establishing connections. Additionally, implementing network-level protections such as SSH traffic monitoring, anomaly detection, and use of VPNs or secure tunnels can reduce the risk of MITM attacks. Regularly auditing SSH known_hosts files and rotating SSH keys can also help detect and prevent unauthorized key changes. Finally, restricting access to the Satellite server and its managed hosts to trusted networks and users minimizes the attack surface. Comprehensive logging and alerting on SSH connection anomalies will aid in early detection of exploitation attempts.

Description

A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key. This issue does not directly allow unauthorized remote execution on the Satellite, although it can leak secrets that may lead to it.

Impact

The primary impact of CVE-2024-4871 is the compromise of confidentiality and integrity of data transmitted during remote execution jobs in Satellite 3.9.1.8. An attacker capable of intercepting or spoofing SSH connections can perform MITM attacks, leading to leakage of sensitive secrets such as credentials, configuration files, or other confidential information. This exposure can facilitate further attacks, including unauthorized access or privilege escalation within the affected environment. Although the vulnerability does not directly allow unauthorized remote code execution on the Satellite server, the leaked secrets could be leveraged by attackers to gain such access indirectly. Additionally, denial of service scenarios may arise if attackers disrupt SSH communications by exploiting this flaw. Organizations relying on Satellite for infrastructure management and automation are at risk of operational disruption and data breaches, potentially impacting compliance and trust. The medium severity rating reflects the balance between the significant data exposure risk and the complexity required to exploit the vulnerability.

Summary

CVE-2024-4871 is a security vulnerability identified in Red Hat Satellite version 3.9.1.8. The core issue arises from the use of SSH remote execution jobs that connect to hosts without verifying the host's SSH key authenticity. Specifically, the Satellite software uses the SSH option '-o StrictHostKeyChecking=no', which disables strict host key checking and allows connections to hosts even if their SSH keys have changed or are unrecognized. This behavior opens the door for man-in-the-middle (MITM) attacks, where an attacker can intercept or alter communications by presenting a forged SSH key. The attacker can exploit this to leak sensitive information contained in the remote execution jobs, such as credentials, configuration data, or other secrets. While the vulnerability does not directly grant unauthorized remote execution capabilities on the Satellite server itself, the confidentiality and integrity of the data exchanged are compromised. The vulnerability has a CVSS 3.1 base score of 6.8, reflecting a medium severity level. The attack vector is network-based, requires low privileges, and no user interaction, but the attack complexity is high due to the need to intercept or spoof SSH connections. No public exploits have been reported yet, but the risk remains significant due to the sensitive nature of the leaked data and the potential for follow-on attacks. This vulnerability highlights the importance of proper SSH host key verification to prevent MITM attacks in automated remote execution environments.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Feb 2026, 15:15 UTC

Technical details

References

Community reviews

Related threats