This Red Hat security advisory (RHSA-2026:42151) covers a set of six vulnerabilities in Red Hat Satellite 6.18 for RHEL 9 and related components. The vulnerabilities include: CVE-2026-33186, an authorization bypass in gRPC-Go due to improper HTTP/2 path validation; CVE-2026-25679, incorrect parsing of IPv6 host literals in net/url; CVE-2026-39821, privilege escalation via incorrect Punycode label processing in golang.org/x/net/idna; CVE-2026-33811, denial of service via long CNAME response in Go net package; CVE-2026-27145, denial of service via excessive processing of DNS SAN entries in golang crypto/x509; and CVE-2026-12701, a directory traversal vulnerability in python3.12-pulpcore's relative_path_validator bypass in FilesystemExport. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively allow attackers to bypass authorization controls, escalate privileges, cause denial of service conditions, and perform directory traversal attacks within Red Hat Satellite environments. These impacts can compromise system integrity, availability, and security of managed systems. The severity is rated as high by the source data, reflecting the potential for significant security impact if exploited.

Red Hat has released updated packages in Red Hat Satellite 6.18.7.1 to address these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems are installed. Detailed update instructions are available in the Red Hat advisory. No indication of alternative mitigations or that no action is required is provided, so applying the official update is the recommended remediation.