Critical Red Hat Satellite Flaw Lets Attackers Steal Root Passwords, Execute Code

Key Takeaways

• A critical vulnerability (CVE-2026-96659) has been discovered in Red Hat Satellite’s Foreman component.
• The flaw allows low-privileged authenticated users to access sensitive host data, including root passwords.
• Under specific insecure configurations, the vulnerability can escalate to arbitrary code execution.
• Red Hat has released fixes for affected versions of Satellite, urging immediate patching.

Major Security Flaw in Red Hat Satellite Exposes Root Passwords and Allows Code Execution

A significant security vulnerability has been identified and patched in Red Hat Satellite, a widely used platform for managing Red Hat Enterprise Linux environments. The flaw, designated CVE-2026-96659, permits an authenticated user with minimal privileges to extract highly sensitive host information, including root passwords. Furthermore, under certain insecure configurations, this vulnerability could be exploited to execute arbitrary commands as the Foreman service account.

Red Hat has rated this issue with an “Important” severity and assigned it a CVSS v3 score of 9.1, indicating a high potential impact. The vulnerability, publicly disclosed on October 1, 2026, primarily affects the Foreman component within Red Hat Satellite, which is central to infrastructure provisioning, configuration management, and lifecycle operations.

Understanding the Vulnerability: CVE-2026-96659

Exploitation of CVE-2026-96659 requires network access and a valid, low-privileged user account; no user interaction is necessary. The successful compromise carries a high confidentiality impact due to the nature of the exposed data.

The root cause of this vulnerability lies in an authorization bypass within Foreman’s template preview endpoints. Specifically, a user assigned only the “Viewer” role can craft malicious requests to these endpoints. This allows them to retrieve information that should be strictly accessible only to administrators or users with higher privileges.

Red Hat confirmed that these vulnerable endpoints can expose critical host attributes, most notably host root passwords. This presents a severe risk for organizations leveraging Red Hat Satellite to provision or manage extensive fleets of Red Hat Enterprise Linux systems, as stolen credentials could lead to widespread system compromise.

The flaw is categorized under CWE-267, an access-control weakness that enables users to bypass intended permissions and access restricted features, sensitive data, or administrative functions. A compromised Viewer account could thus serve as a critical entry point for broader network exposure, enabling attackers to move laterally, alter workloads, or establish persistent access within an environment.

Escalation to Remote Code Execution

While the primary impact of CVE-2026-96659 is unauthorized information disclosure, Red Hat has issued a warning regarding a more severe security implication: remote code execution. This escalation is possible when Foreman template “Safemode” protections are either disabled or can be circumvented.

In such insecure configurations, an attacker could execute arbitrary commands as the Foreman service account. This grants a foothold on the Satellite server itself, a particularly alarming scenario given that Satellite often stores credentials, host inventory data, provisioning templates, configuration details, and content-management access for entire enterprise Linux infrastructures.

Organizations should also be aware of a related vulnerability, CVE-2026-96658, a separate Foreman Safemode bypass flaw that also enables remote code execution. Red Hat’s advisory for Satellite 6.16 highlights both issues, emphasizing that these related Foreman security concerns should be prioritized for patching rather than addressing CVE-2026-96659 in isolation.

Patches and Mitigation

Red Hat has released fixes for the affected products, including:

• Red Hat Satellite 6.16 (RHEL 8 and RHEL 9) – Fixed in RHSA-2026:74506
• Red Hat Satellite 6.18 (RHEL 9) – Fixed in RHSA-2026:74504
• Red Hat Satellite 6.19 (RHEL 9) – Fixed in RHSA-2026:74503

For Satellite 6.16, the fix is included in Foreman version 3.12.0.23-1, delivered as part of the Satellite 6.16.14 update. The advisory also addresses several other security flaws within Foreman and related Satellite components.

What You Should Do

• Apply the relevant Red Hat security errata immediately to all affected Red Hat Satellite installations.
• Review all accounts assigned the “Viewer” role and ensure that their permissions are strictly necessary and minimized.
• Verify that Foreman Safemode protection remains enabled and has not been inadvertently disabled or bypassed.
• Investigate template preview activity for any unusual requests or attempts to access sensitive host attributes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.