The vulnerability in Red Hat Satellite 6 involves an authorization bypass through a user-controlled key. Authenticated users granted the 'view_keypairs' permission can circumvent taxonomy scoping restrictions, enabling them to access and download private SSH keys belonging to other organizations within the same multi-tenant environment. This flaw exposes sensitive cryptographic material across tenant boundaries, potentially compromising confidentiality. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official remediation or patch information is provided in the vendor advisory at this time.

This vulnerability allows unauthorized access to private SSH keys across organizational boundaries in multi-tenant deployments of Red Hat Satellite 6. The exposure of private keys can lead to compromise of secure shell access credentials, potentially undermining the confidentiality of affected tenants. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5142 for current remediation guidance. Until a fix is available, restrict 'view_keypairs' permissions to trusted users only to minimize risk. Monitor Red Hat communications for updates on official fixes or workarounds.