Red Hat has fixed a serious access-control weakness in Red Hat Satellite that can expose protected host information to a low-privileged user. In affected environments, an account holding only the Viewer role may be able to retrieve sensitive attributes, including root passwords used for managed systems.

The vulnerability is tracked as CVE-2026-96659 and carries a CVSS v3 score of 9.1. Red Hat rates it Important. The issue affects Foreman, the provisioning and lifecycle-management component at the center of Satellite. No victim interaction is required, but an attacker must have network access and a valid low-privileged account.

Satellite commonly manages large fleets of enterprise Linux hosts and holds inventory data, templates, configuration details and provisioning credentials. That concentration of trust means disclosure through a nominally read-only account can have consequences far beyond the management console.

Viewer role crosses an authorization boundary

The weakness resides in Foreman template-preview endpoints. A user assigned the Viewer role can send crafted requests that cause those endpoints to reveal information intended for more privileged administrators. Red Hat classifies the problem as CWE-267, an access-control weakness involving privileges, identities or restricted functionality.

Host attributes exposed through the vulnerable path may include root passwords. If an attacker obtains a valid credential for a managed machine, they can bypass the intended separation between Satellite roles and host administration. The result could include lateral movement, workload modification, data access or persistent control across parts of the Linux estate.

This is why the account prerequisite should not be mistaken for a minor barrier. Viewer access may be more widely distributed than administrative access, and credentials for low-impact roles can be obtained through phishing, password reuse, leaked tokens or compromised endpoints. A vulnerability that upgrades that foothold into sensitive credential access is a meaningful escalation path.

Unsafe Safemode settings increase the impact

Information disclosure is the primary impact under normal conditions. Red Hat warns, however, that the vulnerability can become more severe when Foreman template Safemode protections are disabled or can be bypassed. In that situation, crafted template activity may lead to arbitrary commands running as the Foreman service account.

Command execution on the Satellite server would put a central management system at risk. Even where the service account is not root, it may have access to application secrets, host records, content-management functions and trusted connections. Attackers could use that position to deepen access or alter provisioning workflows.

The Satellite 6.16 advisory also includes CVE-2026-96658, a separate Foreman Safemode bypass that can lead to remote code execution. Administrators should therefore treat the release as a coordinated Foreman security update and address the listed issues together, rather than patching only the password-disclosure path.

Fixed releases

Red Hat has published corrected packages for Satellite 6.16 on Red Hat Enterprise Linux 8 and 9 under advisory RHSA-2026:74506. Satellite 6.18 on RHEL 9 is covered by RHSA-2026:74504, and Satellite 6.19 on RHEL 9 by RHSA-2026:74503.

For Satellite 6.16, the fix includes Foreman 3.12.0.23-1 in the Satellite 6.16.14 update. The relevant advisories contain additional fixes for Foreman and related components, so teams should follow the product-specific update procedure and confirm that all required packages and services have been refreshed.

Response steps for Satellite administrators

• Apply the security errata for the installed Satellite release without delay.
• Confirm Foreman template Safemode remains enabled and cannot be bypassed.
• Review Viewer-role memberships and remove accounts that no longer require access.
• Inspect template-preview requests for unusual parameters or access to sensitive attributes.
• Rotate exposed root credentials and investigate the affected hosts for unauthorized access.

Teams should also review authentication logs for compromised Viewer accounts and correlate them with host login records. If audit data suggests that sensitive template output was retrieved, containment should extend to the managed systems whose credentials may have appeared. Patching closes the authorization weakness; credential rotation and investigation address the possibility that information was already taken.

Source: Cyber Security News, based on Red Hat’s Satellite security advisories.