The vulnerability in Red Hat Satellite 6.19 for RHEL 9 is due to a semantic logic flaw in the host_verifier.rb component of Foreman. The /unattended/provision API endpoint incorrectly validates provisioning tokens by checking the database state instead of the actual HTTP request token. Because a host undergoing provisioning has an unexpired token in the database, the valid_host_token? method returns true even if no token is supplied in the request, resulting in an authentication bypass that grants access to the kickstart template.

An attacker can bypass authentication controls on the /unattended/provision API endpoint, gaining unauthorized access to the kickstart template. This could potentially allow unauthorized provisioning actions or information disclosure related to system provisioning. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Red Hat has issued an official security advisory (RHSA-2026:74503) that includes a patch for this vulnerability. Users of Red Hat Satellite 6.19 for RHEL 9 should apply the update provided in this advisory to remediate the authentication bypass. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official documentation for detailed update instructions.