This Red Hat Security Advisory (RHSA-2026:34365) addresses multiple vulnerabilities in Red Hat Satellite 6.19.2 and related components. Key fixes include arbitrary code execution via JNDI dereferencing (CVE-2026-27727), certificate validation bypass and denial of service issues in yggdrasil-worker-forwarder, authentication bypass in python-pyjwt (CVE-2026-48526), and several critical vulnerabilities in foreman such as cross-tenant SSH key disclosure (CVE-2026-5142), information disclosure (CVE-2026-5138), privilege escalation (CVE-2026-5136), and unauthorized host configuration modification due to broken access control (CVE-2026-5135). The advisory consolidates 13 CVEs affecting system management, provisioning, and security components of Red Hat Satellite. The update is classified as important and addresses security weaknesses that could lead to elevated privileges, information leaks, denial of service, and code execution. The vendor recommends applying this update after all prior errata are installed.

The vulnerabilities fixed in this advisory have high security impact, including the potential for arbitrary code execution, privilege escalation to administrator level, authentication bypass, information disclosure across tenants, and denial of service conditions. Exploitation could allow attackers to execute malicious code, gain unauthorized administrative access, disclose sensitive SSH keys and configuration data, or disrupt service availability. These issues affect critical components of Red Hat Satellite's system management and provisioning infrastructure, potentially compromising the confidentiality, integrity, and availability of managed systems.

Red Hat has released an updated version of Red Hat Satellite 6.19.2 that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available in the official Red Hat Satellite documentation. No additional vendor-recommended mitigations or workarounds are specified beyond applying the official update.