Red Hat Satellite 6.18.10 and 6.16.14 Address Critical Vulnerabilities
Tech GuruQuick Answer
Use Satellite 6.18.10 for the supported 6.18/RHEL 9 stream or 6.16.14 for the listed 6.16/RHEL 8 or 9 stream. The advisories cover provisioning disclosure, authorization and code-execution risks plus dependency issues; their combined CVE list is not identical per branch. Follow the branch-specific Satellite update procedure, not a generic container or accelerator update.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Red Hat Satellite 6.18 on RHEL 9 and Satellite 6.16 on RHEL 8 or 9, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Satellite 6.18 on RHEL 9 and Satellite 6.16 on RHEL 8 or 9 |
|---|---|
| Advisory | RHSA-2026:74504 / RHSA-2026:74506 |
| CVEs | CVE-2026-12405, CVE-2026-12423, CVE-2026-12540, CVE-2026-12541, CVE-2026-12542, CVE-2026-12544, CVE-2026-12545, CVE-2026-33154, CVE-2026-33818, CVE-2026-42504, CVE-2026-49825, CVE-2026-54284, CVE-2026-56097, CVE-2026-56098, CVE-2026-56858, CVE-2026-56860, CVE-2026-56862, CVE-2026-59893, CVE-2026-71491, CVE-2026-78679, CVE-2026-79654, CVE-2026-87817, CVE-2026-96658, CVE-2026-96659 |
| Authoritative release date | 2026-10-01 23:03:50 UTC |
| Authority revision date | Latest current_release_date in the checked advisory set: 2026-10-02T18:49:01+00:00. Individual advisories may have earlier revisions. |
| Affected versions | Satellite 6.18 builds before 6.18.10 and Satellite 6.16 builds before 6.16.14, subject to each advisory's package scope. |
| Fixed version | Red Hat Satellite 6.18.10 / 6.16.14 |
| CVSS base score | 4.3–9.9 (official CVSS v3.1 range) |
| CVSS severity | Medium to Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The fixes include Foreman and Katello authorization boundaries, provisioning tokens, remote-execution input handling and supporting libraries. The 6.16 advisory explicitly changes token enforcement for operating-system entries with Redhat family: generic or subnet boot disks may no longer match and boot hosts. Use a supported token-bearing Full Host Bootdisk workflow and test provisioning before a broad rollout.
What To Validate Now
- Inventory. Locate Red Hat Satellite 6.18 on RHEL 9 and Satellite 6.16 on RHEL 8 or 9 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match entitlement, product stream, architecture, source package or image repository, and each advisory's product status. Do not apply one branch's build or digest to another branch.
- Remediate. Apply prerequisite errata and follow the supported Satellite procedure for the installed branch, including required Capsule coordination and backups. Preserve provisioning templates and organization configuration. Do not set installation-token lifetime to zero as a routine compatibility fix: Red Hat warns that this disables token enforcement and can expose sensitive kickstart content.
- Validate. Confirm Satellite and affected component builds, service health, content synchronization and Capsule communication. In an authorized test organization/host, check role boundaries, content access, remote execution and the actual token-bearing provisioning path. Record bootdisk failures without exposing provisioning tokens or kickstart secrets.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Schedule an update with recovery capacity for this management service and its database. A successful web login does not validate provisioning or cross-organization permissions. Preserve evidence before any destructive recovery; do not disable token checks or substitute upstream libraries to bypass an update problem.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
