This advisory covers a set of 13 security vulnerabilities in Red Hat Satellite 6.19 for RHEL 9, fixed in version 6.19.2. Key issues include arbitrary code execution via JNDI dereferencing (CVE-2026-27727), authentication bypass through forged JSON Web Tokens (CVE-2026-48526), multiple denial of service vulnerabilities in Go crypto libraries and Python Pillow, and several critical flaws in Foreman allowing cross-tenant SSH key disclosure (CVE-2026-5142), information disclosure (CVE-2026-5138), privilege escalation to administrator (CVE-2026-5136), and unauthorized host configuration modification due to broken access control (CVE-2026-5135). The vulnerabilities affect components responsible for provisioning, configuration management, and certificate validation within Red Hat Satellite. The advisory recommends updating to Satellite 6.19.2 to remediate these issues.

The vulnerabilities collectively allow attackers to execute arbitrary code, bypass authentication, cause denial of service, disclose sensitive information, escalate privileges to administrator level, and modify host configurations without authorization. These impacts can compromise the confidentiality, integrity, and availability of systems managed by Red Hat Satellite 6.19 prior to 6.19.2. The privilege escalation and broken access control issues in Foreman are particularly critical as they may allow unauthorized administrative access and control over managed hosts.

Red Hat has released Red Hat Satellite 6.19.2 which includes fixes for all listed vulnerabilities. Users should apply this update promptly after ensuring all prior errata relevant to their system are installed. Detailed update instructions are available in the official Red Hat Satellite documentation. No additional mitigations are indicated by the vendor advisory beyond applying the update.