CVE-2026-96659 – Red Hat Satellite 6.16 for RHEL 8
“When the server that manages your entire fleet can be turned against it, one low-level login is all it takes to own everything downstream.”
This update closes seven Critical and High severity flaws in Red Hat Satellite 6.16 for RHEL 8 and its Foreman components. CVE-2026-96658 has a CVSS score of 9.9, Critical severity: a low-privileged authenticated attacker can bypass the templating engine's safemode sandbox and run arbitrary commands on the Satellite server. CVE-2026-96659 has a CVSS score of 9.1, Critical severity: a user with only Viewer permissions can pull sensitive data such as host root passwords through template preview endpoints, and can execute commands when Safemode is disabled.
The remaining fixes target command injection and access control failures. CVE-2026-12405 has a CVSS score of 8.8, High severity, and lets users who can run job templates inject shell commands through the effective_user parameter on managed hosts. CVE-2026-12540 and CVE-2026-12541 each have a CVSS score of 8.2, High severity, and allow command injection through foreman-rake log retrieval and database dump/import tasks. CVE-2026-12544 has a CVSS score of 7.7, High severity, and enables template injection and insecure deserialization that can lead to full infrastructure compromise. CVE-2026-12423 has a CVSS score of 7.5, High severity, and lets an unauthenticated requester retrieve kickstart templates for hosts mid-provisioning without supplying a token.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-267