Threats affecting pkg:brew/kimi-cli

Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.

This update for python-python-multipart fixes the following issues - CVE-2026-40347: crafted `multipart/form-data` can cause a denial of service (bsc#1262403). - CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).

Authlib versions prior to 1.6.12 and 1.7.1 contain an unauthenticated open redirect vulnerability in the OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints. This flaw is triggered by omitting the 'openid' scope in authorization requests, causing the server to redirect to an attacker-chosen URL without validating the redirect URI. The vulnerability affects servers supporting OpenID Connect Implicit or Hybrid flows and can be exploited without authentication or valid client IDs. While it does not directly leak tokens or authorization codes, it enables phishing attacks by leveraging the trusted authorization server's domain in the browser's URL bar. A fix is available for this vulnerability.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python-GitPython fixes the following issues - CVE-2026-42215: command injection via Git options bypass (bsc#1264604). - CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605). - CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (bsc#1264606). - CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).

Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models (LLMs) for enterprise applications.

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

This update for python-Authlib fixes the following issues: Changes in python-Authlib: - CVE-2026-27962: JWS `deserialize_compact()` allows for signature bypass by accepting user-controlled embedded JWK as verification key (bsc#1259738) - CVE-2026-28490: cryptographic padding oracle in JWE RSA1_5 key management algorithm (bsc#1259736) - CVE-2026-28498: fail-open in behavior OIDC hash validation allows for bypass mandatory integrity protections (bsc#1259737)

This update for python-lxml_html_clean fixes the following issues: Changes in python-lxml_html_clean: - CVE-2026-28348: improper keywords checking can allow external CSS loading (bsc#1259378) - CVE-2026-28350: lack of base tag handling can allow the hijacking of the resolution of relative URLs (bsc#1259379)

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python-python-multipart fixes the following issues: - CVE-2026-24486: Fixed non-default configuration options can lead to path traversal (bsc#1257301).

This update for python-jaraco.context fixes the following issues: - CVE-2026-23949: Fixed malicious tar archives may lead to path traversal (bsc#1256954).