Satellite

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

Published: 2026-10-01T16:23:23.688Z
Updated: 2026-11-02T18:02:52.712Z

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.

Published: 2023-12-18T13:43:07.747Z
Updated: 2025-11-20T18:27:27.972Z

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

Published: 2023-09-20T13:40:43.213Z
Updated: 2024-09-24T15:05:20.612Z

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

Published: 2023-09-20T13:39:27.756Z
Updated: 2024-09-17T13:51:28.373Z

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Published: 2019-04-11T14:31:40.000Z
Updated: 2024-08-04T19:19:18.596Z