The vulnerability CVE-2026-69243 affects aiohttp's HTTP parser, enabling HTTP request smuggling during WebSocket upgrade requests that contain a body. The parser may switch protocols before fully receiving the body, causing trailing data to be misinterpreted as subsequent requests or upgraded protocol data. This flaw can be exploited to bypass firewall protections, poison web caches, or access unauthorized resources. Red Hat products that utilize aiohttp in a server-side capacity, such as Red Hat Satellite, are affected. The vulnerability is rated as having high confidentiality impact, low integrity and availability impact, and requires no privileges or user interaction to exploit. Red Hat has made a new container image generally available but has not indicated an official patch or fix for this issue yet.

This vulnerability allows an attacker to perform HTTP request smuggling via WebSocket upgrade requests, potentially bypassing security controls, poisoning web caches, or gaining unauthorized access to web applications. The impact is rated as moderate by Red Hat, with high confidentiality impact and low integrity and availability impact. No known exploits in the wild have been reported. The vulnerability affects Red Hat products that use aiohttp server-side components, including Red Hat Satellite.

Red Hat has released a new satellite/iop-insights-engine-rhel9 container image generally available in the Red Hat container registry. However, no specific patch or fix for CVE-2026-69243 has been provided yet. Users should monitor Red Hat advisories for updates and consider deploying the updated container image as recommended in Red Hat Satellite documentation. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated.