This advisory covers six security vulnerabilities in Red Hat Satellite 6.17.9.1. CVE-2026-12701 is a directory traversal vulnerability in pulpcore's FilesystemExport allowing bypass of relative path validation. CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package used by yggdrasil-worker-forwarder. CVE-2026-33186 is an authorization bypass in gRPC-Go due to improper HTTP/2 path validation. CVE-2026-39821 is a privilege escalation via incorrect Punycode label processing in golang.org/x/net/idna. CVE-2026-33811 and CVE-2026-27145 are denial of service vulnerabilities caused by excessive processing of DNS responses in Go net and crypto/x509 packages, respectively. The advisory includes a fix for an upgrade failure from Satellite 6.16 to 6.17 related to pulpcore-manager rpm-datarepair. The update is rated as Important by Red Hat Product Security.

Successful exploitation of these vulnerabilities could allow attackers to bypass security controls (authorization bypass), escalate privileges, perform directory traversal to access unauthorized files, or cause denial of service conditions by exhausting system resources. The vulnerabilities affect core components responsible for system provisioning and configuration management, potentially impacting the integrity and availability of managed systems.

Red Hat has released an official update for Red Hat Satellite 6.17.9.1 that addresses all listed vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems are installed. Detailed update instructions are available in Red Hat's official documentation. No additional mitigations are indicated beyond applying the provided patches.