Red Hat Security Advisory: Satellite 6.16.10 Async Update
Red Hat Satellite 6.16.10 for RHEL 8 and 9 addresses multiple security vulnerabilities including privilege escalation, information disclosure, unauthorized modification of host configurations, and cross-tenant private SSH key disclosure. These issues stem from broken access controls, improper validation of nested request parameters, and taxonomy scoping bypasses in Foreman components. The update is rated as Important by Red Hat Product Security and fixes these vulnerabilities to prevent unauthorized administrative access and data leaks.
AI Analysis
Technical Summary
This advisory covers several vulnerabilities in Red Hat Satellite 6.16.10 and its Foreman components. CVE-2026-5135 involves unauthorized modification of host configurations due to broken access control. CVE-2026-5136 allows privilege escalation to administrator-level access via manipulation of usergroup role assignments. CVE-2026-5138 concerns information disclosure through improper validation of nested request parameters. CVE-2026-5142 enables cross-tenant private SSH key disclosure via taxonomy scoping bypass. These vulnerabilities affect Foreman and satellite-capsule packages on RHEL 8 and 9. The update fixes these issues and also addresses a bug related to repository enabling in foreman-maintain.
Potential Impact
Successful exploitation of these vulnerabilities could allow attackers to escalate privileges to administrator level, modify host configurations without authorization, disclose sensitive information including private SSH keys across tenants, and gain unauthorized access to system management functions. This could compromise the confidentiality, integrity, and availability of managed systems and their configurations.
Mitigation Recommendations
Red Hat has released an update for Red Hat Satellite 6.16.10 for RHEL 8 and 9 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems are installed. Detailed update instructions are available from Red Hat's official documentation. No indication of alternative mitigations or workarounds is provided, so applying the official update is the recommended remediation.
Red Hat Security Advisory: Satellite 6.16.10 Async Update
Description
Red Hat Satellite 6.16.10 for RHEL 8 and 9 addresses multiple security vulnerabilities including privilege escalation, information disclosure, unauthorized modification of host configurations, and cross-tenant private SSH key disclosure. These issues stem from broken access controls, improper validation of nested request parameters, and taxonomy scoping bypasses in Foreman components. The update is rated as Important by Red Hat Product Security and fixes these vulnerabilities to prevent unauthorized administrative access and data leaks.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers several vulnerabilities in Red Hat Satellite 6.16.10 and its Foreman components. CVE-2026-5135 involves unauthorized modification of host configurations due to broken access control. CVE-2026-5136 allows privilege escalation to administrator-level access via manipulation of usergroup role assignments. CVE-2026-5138 concerns information disclosure through improper validation of nested request parameters. CVE-2026-5142 enables cross-tenant private SSH key disclosure via taxonomy scoping bypass. These vulnerabilities affect Foreman and satellite-capsule packages on RHEL 8 and 9. The update fixes these issues and also addresses a bug related to repository enabling in foreman-maintain.
Potential Impact
Successful exploitation of these vulnerabilities could allow attackers to escalate privileges to administrator level, modify host configurations without authorization, disclose sensitive information including private SSH keys across tenants, and gain unauthorized access to system management functions. This could compromise the confidentiality, integrity, and availability of managed systems and their configurations.
Mitigation Recommendations
Red Hat has released an update for Red Hat Satellite 6.16.10 for RHEL 8 and 9 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems are installed. Detailed update instructions are available from Red Hat's official documentation. No indication of alternative mitigations or workarounds is provided, so applying the official update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:34367
- Cve Count
- 4
- Additional Cves
- ["CVE-2026-5136","CVE-2026-5138","CVE-2026-5142"]
- Cvss Version
- null
Threat ID: 6a46ed1527e9c7971944707f
Added to database: 07/02/2026, 22:58:29 UTC
Last enriched: 07/02/2026, 23:34:45 UTC
Last updated: 07/03/2026, 03:51:10 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.