Critical Red Hat Satellite Flaw Exposes Root Passwords, Enables Code Execution
A critical vulnerability in Red Hat Satellite, CVE-2026-96659, allows low-privileged users to steal root passwords and potentially execute arbitrary code.
Red Hat has addressed a critical vulnerability within its Red Hat Satellite platform that could allow authenticated users with minimal privileges to access sensitive host information, including root passwords. In certain insecure configurations, this flaw also opens the door for arbitrary command execution with the privileges of the Foreman service account.
Tracked as CVE-2026-96659, the vulnerability resides in the Foreman component, which is integral to Red Hat Satellite's capabilities for infrastructure provisioning, configuration management, and lifecycle operations. Publicly disclosed on October 1, 2026, Red Hat has assigned the vulnerability an 'Important' severity rating with a CVSS v3 score of 9.1. Successful exploitation requires network access and a valid low-privileged account, but notably does not necessitate any user interaction, leading to a high confidentiality impact.
The root cause of the vulnerability is an authorization weakness within Foreman's template preview endpoints. Attackers with a user role as low as 'Viewer' can submit specially crafted requests to these endpoints. This allows them to retrieve sensitive host attributes that should only be accessible to administrators with higher privileges, effectively bypassing intended access controls.
According to Red Hat's advisory, the affected endpoints can expose critical host details, including root passwords for managed Red Hat Enterprise Linux systems. This poses a significant risk to organizations relying on Satellite for managing large fleets of servers. The vulnerability falls under CWE-267, an access control weakness that permits users to access restricted data and administrative functions beyond their assigned permissions.
While the primary impact is unauthorized information disclosure, the security implications escalate dramatically if Foreman's template Safemode protections are disabled or can be bypassed. In such scenarios, an attacker could execute arbitrary commands as the Foreman service account. This would grant them a foothold directly on the Satellite server itself, a particularly concerning prospect given that Satellite often stores credentials, inventory data, provisioning templates, and content management access for an organization's Linux infrastructure.
Adding to the urgency, Red Hat's advisory for Satellite 6.16 also mentions CVE-2026-96658, a separate Foreman Safemode bypass flaw that can also lead to remote code execution. Organizations are strongly advised to treat these related Foreman security issues as a priority patching event, rather than addressing CVE-2026-96659 in isolation.
Red Hat has released fixes for Red Hat Satellite versions 6.16, 6.18, and 6.19. For Satellite 6.16, the fix is included in the Satellite 6.16.14 update, which bundles Foreman version 3.12.0.23-1 for RHEL 8 and RHEL 9. Administrators are urged to apply the relevant security errata immediately. Furthermore, they should meticulously review all accounts assigned the Viewer role, revoke unnecessary access, verify that Foreman Safemode protection remains enabled, and investigate template preview activity for any suspicious requests or access to sensitive host attributes.