Red Hat Satellite 6.18 includes Red Hat Lightspeed, which analyzes system health locally. A vulnerability identified as CVE-2026-28684 exists in the python-dotenv library, where the set_key() and unset_key() functions follow symbolic links when rewriting .env files. This behavior can be exploited by a local attacker to overwrite arbitrary files on the system, potentially impacting integrity and availability. The vulnerability is associated with CWE-59 (Improper Link Resolution Before File Access). Red Hat has not provided an official patch or fix that meets their criteria but has released the satellite/iop-host-inventory-rhel9 container image generally available. The advisory references multiple CVEs but focuses on this specific flaw. Red Hat scores this vulnerability as high severity with a CVSS base score of 7.1, emphasizing local attack vector, low complexity, and low privileges required. No known exploits are reported in the wild. The advisory includes links to Red Hat documentation and the container image registry.

The vulnerability allows a local attacker to overwrite arbitrary files on the affected system by exploiting symbolic link following in python-dotenv's set_key() and unset_key() functions. This can lead to integrity and availability impacts, such as unauthorized modification of files and potential disruption of system operations. Confidentiality is not impacted. The flaw could also enable bypassing of security mechanisms if critical files are overwritten. The attack requires local access with low privileges and has low complexity. No remote exploitation or known active exploitation in the wild has been reported.

Currently, no official fix or patch meeting Red Hat's criteria for ease of use, applicability, or stability is available. Users should follow Red Hat Satellite documentation to install and configure Red Hat Lightspeed locally to generate recommendations without sending system data externally. Customers are advised to monitor Red Hat advisories for future updates or fixes. If possible, restrict local access to trusted users to reduce risk. Customers with Red Hat Technical Account Managers (TAM) can consult them for tailored guidance. No additional mitigations are specified in the advisory.