Red Hat Satellite, a system management solution for provisioning and configuration management, has multiple security vulnerabilities fixed in versions 6.16.11 and 6.19.2.1. Key fixes include CVE-2026-12701, a directory traversal bypass in pulpcore's relative_path_validator allowing FilesystemExport bypass; CVE-2026-27145 and CVE-2026-33811, denial of service vulnerabilities in golang crypto/x509 and net packages related to DNS SAN entries and long CNAME responses; CVE-2026-39821, a privilege escalation via incorrect Punycode label processing in golang.org/x/net/idna; and CVE-2026-33186, an authorization bypass in gRPC-Go due to improper HTTP/2 path validation. These issues affect Red Hat Satellite 6.16 for RHEL 8 and 9, and 6.19 for RHEL 9. Red Hat has released updated packages to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could allow attackers to bypass path validation controls, cause denial of service conditions through excessive processing of DNS data, escalate privileges via malformed Punycode labels, or bypass authorization checks in gRPC-Go. This could impact the integrity, availability, and security of systems managed by Red Hat Satellite, potentially allowing unauthorized access or disruption of system management operations.

Red Hat has released official updates for Red Hat Satellite 6.16.11 and 6.19.2.1 that address these vulnerabilities. Users should apply these updates promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigations are indicated beyond applying the vendor-provided patches.