The vulnerability in Red Hat Satellite 6's foreman-mcp-server involves two logging mechanisms that expose sensitive authentication data. Session identifiers, which serve as authentication credentials, are logged at an informational level. Additionally, when debug logging is enabled, HTTP request headers are not fully sanitized, causing sensitive information such as authorization tokens and API keys to be logged in cleartext. These logs are persisted within container logs, increasing the risk of unauthorized access to sensitive credentials, especially if logs are forwarded to centralized logging platforms.

The vulnerability results in a confidentiality breach by exposing sensitive authentication data in plaintext logs. This increases the risk of credential compromise if an attacker gains access to these logs. There is no indication of impact on integrity or availability. The CVSS score of 6.2 (medium severity) reflects the local attack vector and the confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-9073 for current remediation guidance. Until a fix is available, avoid enabling debug logging in production environments to prevent sensitive data from being logged. Review and restrict access to container logs and any centralized logging platforms to minimize exposure of sensitive information.