This Red Hat Satellite 6.17.9 security advisory fixes six CVEs affecting Red Hat Satellite 6.17 for RHEL 9. The vulnerabilities include CVE-2026-5135 (unauthorized modification of host configurations via broken access control), CVE-2026-5136 (privilege escalation to administrator-level via usergroup role assignment manipulation), CVE-2026-5138 (information disclosure via improper validation of nested request parameters), CVE-2026-5142 (cross-tenant private SSH key disclosure via taxonomy scoping bypass), CVE-2026-32282 (Root.Chmod following symlinks out of root), and CVE-2026-40192 (denial of service via decompression bomb in FITS image processing in python-pillow). The advisory includes bug fixes and instructs users to apply all previously released errata before updating. The vulnerabilities impact core system management functions and could lead to privilege escalation, data leakage, and denial of service if unpatched.

The vulnerabilities collectively allow attackers to escalate privileges to administrator level, disclose sensitive information including private SSH keys across tenants, modify host configurations without authorization, and cause denial of service conditions. The symlink traversal issue could allow unauthorized file permission changes outside intended directories. These impacts compromise system integrity, confidentiality, and availability within Red Hat Satellite environments prior to version 6.17.9.

Red Hat has released an official update in Red Hat Satellite 6.17.9 that addresses all listed vulnerabilities. Users should apply this update after ensuring all prior errata are installed. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigations are indicated beyond applying the official patch.