Red Hat fixes critical sandbox bypass in Satellite

Red Hat published 21 CVEs on 12 November 2026, including one critical flaw rated 9.6: CVE-2026-107360 in Red Hat Satellite’s rubygem-safemode template sandbox. Red Hat says compound assignment expressions can bypass the sandbox’s Jail allow-list. An authenticated user able to edit template content could then invoke methods that should be blocked, potentially including host deletion.

The vulnerabilities affect Satellite 6.16, 6.17 and 6.18, as well as packages in Red Hat Enterprise Linux (RHEL) and Ansible Automation Platform (AAP). Red Hat lists no exploitation for any of the 21 CVEs; none is listed in CISA’s Known Exploited Vulnerabilities catalogue.

Other Satellite flaws include Foreman API authorisation gaps that can let users create access tokens or add SSH keys to other accounts, and exposure of rendered templates containing host root passwords. Further issues affect Candlepin and smart_proxy_dynflow, where a certificate holder may be able to view job details, including passwords passed to jobs.

Across the full disclosure, Red Hat also identified RHEL flaws including a path traversal in yggdrasil-worker-package-manager and a risk to confidential virtual-machine memory, alongside AAP issues such as an unauthenticated AWX debug endpoint.

Red Hat errata RHSA-2026:99949, 99950 and 99952 address five Satellite vulnerabilities. Fixed builds include rubygem-safemode 1.5.0-3 and, depending on the Satellite release, Foreman 3.12.0.26, 3.14.0.26 or 3.16.0.29. RHSA-2026:96082 fixes the yggdrasil flaw on RHEL 10. The source says fixes had not yet been listed for CVE-2026-86324, CVE-2026-86323 and the remaining RHEL and AAP vulnerabilities; it advises restricting template editing and token permissions to trusted administrators while awaiting updates.