CVE-2026-96659

Think of this like a visitor's badge at your office that's supposed to only let someone look around, but it accidentally also opens the safe where passwords are kept. In this case, a 'viewer' account in the Satellite management tool — meant for read-only access — can be used to see server root passwords, and under weaker security settings, even give commands to the server itself.

This matters to you if you run Red Hat Satellite (any of versions 6.16 through 6.19) to manage your Linux servers. It affects anyone who has given out 'Viewer'-level accounts in Satellite, since that low level of access is enough to trigger the issue — no administrator password is needed, just a basic viewer login.

This is urgent: the flaw lets someone with only basic, low-privilege viewer access — not an administrator — pull sensitive root passwords and potentially take over the server, which is a very low bar for an attacker to clear. There's no confirmed sign yet of this being actively exploited in the wild, but the ease of access combined with the severity of what can be exposed means it should be treated as a high priority to patch now rather than later.

Confirm exposure by checking your installed Satellite/Foreman RPM version (rpm -q foreman or equivalent) and verify whether Safemode is enabled in Settings > Provisioning (disabling Safemode significantly raises impact from information disclosure to remote command execution). Target the fixed package per branch: 6.16/RHEL8 → 0:3.12.0.23-1.el8sat; 6.16/RHEL9 → 0:3.12.0.23-1.el9sat; 6.17/RHEL9 → 0:3.14.0.22-1.el9sat; 6.18/RHEL9 → 0:3.16.0.25-1.el9sat; 6.19/RHEL9 → 0:3.18.0.14-1.el9sat. Apply via standard Satellite maintenance/update procedures; no breaking changes are indicated beyond the normal Satellite update path. As a temporary workaround before patching, ensure Safemode is enabled and audit/restrict Viewer-role assignments to trusted users only, since the information-disclosure path depends solely on holding that role. Not listed in CISA KEV and no public exploit code or confirmed in-the-wild exploitation is recorded at this time, so there is no mandated remediation deadline, but prioritize given the low privilege bar (CVSS 9.1, PR:L). Monitor Red Hat/Satellite advisories for any update to exploitation status.

CVSS 3.1 score 9.1 (Critical), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L — network-exploitable, low attack complexity, requires low (Viewer-level) privileges, no user interaction, with a scope change enabling impact beyond the vulnerable component. Weakness class is CWE-267 (Privilege Defined With Unsafe Actions/excessive permission assignment), triggered via the Foreman template preview endpoint, which discloses confidential data (e.g., root passwords) and, when Safemode is disabled, enables command execution as the Foreman service account. Not present in CISA's KEV catalog; no dated news reports of active exploitation; no public exploit code identified. EPSS places predicted exploitation likelihood in a low percentile with a flat trend, consistent with no confirmed in-the-wild activity, though this should not be read as reducing urgency given the severity and low privilege requirement.