Red Hat Satellite 6.19.6 Fixes Critical Authentication and Authorization Flaws
Tech GuruQuick Answer
Apply the supported Satellite 6.19.6 update after relevant earlier errata. Validate Satellite and Capsule roles, authentication, organization boundaries, content workflows and remote execution.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Satellite 6.19 for RHEL 9 servers, Capsules, utilities, enabled integrations, package versions and organizational boundaries. Use the advisory package-to-CVE matrix for each role; the presence of one package does not make every listed CVE applicable. Apply all prerequisite errata, then follow the Red Hat Satellite 6.19 update procedure for RHSA-2026:100120. Use the complete supported package set rather than replacing individual bundled components. Confirm the release and role-specific package builds, then test authentication, permitted organization access, content publication, subscriptions and remote-execution permissions. Retain deployment and audit logs.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Satellite 6.19 for RHEL 9, including applicable Satellite, Capsule and utilities packages |
|---|---|
| Advisory | RHSA-2026:100120 |
| CVEs | CVE-2026-102267, CVE-2026-102268, CVE-2026-102272, CVE-2026-102273, CVE-2026-103870, CVE-2026-106471, CVE-2026-107152, CVE-2026-107360, CVE-2026-107443, CVE-2026-111456, CVE-2026-42784, CVE-2026-61845, CVE-2026-61847, CVE-2026-81668, CVE-2026-86322, CVE-2026-86323, CVE-2026-86324, CVE-2026-90959, CVE-2026-92893, CVE-2026-92904 |
| Authoritative release date | 2026-11-13T14:45:23Z — initial release in Red Hat CSAF tracking. |
| Authority revision date | No separate material revision date is provided by the authority. |
| Affected versions | Advisory-listed Satellite 6.19 for RHEL 9 packages before the RHSA-2026:100120 fixed builds. Component and role applicability is defined by the vendor package matrix. |
| Fixed version | Satellite 6.19.6-1.el9sat and the associated RHSA-2026:100120 package set; use the vendor matrix for each Satellite, Capsule and utilities role. |
| CVSS base score | 9.6 (highest stated CVSS v3.1 base score; CVE-2026-107360) |
| CVSS severity | Critical |
| Exploitation status | Red Hat does not confirm exploitation in the wild in this advisory.; no exploitation claim is inferred. |
What Changed
Red Hat releases Satellite 6.19.6 with fixes for 20 CVEs involving authentication, authorization, cross-tenant operations, file access, signature checks and availability. The highest published base score applies to the safemode jail bypass; it is not a score assigned to every issue.
What To Validate Now
- Inventory. Record Satellite 6.19 for RHEL 9 servers, Capsules, utilities, enabled integrations, package versions and organizational boundaries.
- Establish applicability. Use the advisory package-to-CVE matrix for each role; the presence of one package does not make every listed CVE applicable.
- Remediate. Apply all prerequisite errata, then follow the Red Hat Satellite 6.19 update procedure for RHSA-2026:100120. Use the complete supported package set rather than replacing individual bundled components.
- Validate. Confirm the release and role-specific package builds, then test authentication, permitted organization access, content publication, subscriptions and remote-execution permissions. Retain deployment and audit logs.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Back up Satellite and coordinate dependent Capsules and services before maintenance. CSAF generation timestamps are not additional material release dates. The vendor rates the advisory Critical; component CVSS scores vary.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
