CVE-2026-12515: fallo de gravedad media en Red Hat Hardened Images
Katello: missing repository authorization in content_uploads exposes cross-product content existence
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.2%
probabilidad de explotación
0.2%top 88% de las CVE
explotación observada
noninguna fuente lo reporta
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Red Hat · Red Hat Hardened ImagesRed Hat · Red Hat Satellite 6Red Hat · Red Hat Satellite 6.16 for RHEL 8Red Hat · Red Hat Satellite 6.16 for RHEL 9Red Hat · Red Hat Satellite 6.17 for RHEL 9Red Hat · Red Hat Satellite 6.18 for RHEL 9Red Hat · Red Hat Satellite 6.19 for RHEL 9CVEs relacionadas — Red Hat Hardened Images
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-6893HIGHDracut: dracut: root code execution via dhcp options command injectionEPSS 3.1%CVE-2022-3874HIGHOs command injection via ct_command and fcct_commandEPSS 2.2%CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.5%CVE-2026-5121HIGHLibarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processingEPSS 1.4%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.4%
Referencias
https://access.redhat.com/errata/RHSA-2026:50221https://access.redhat.com/errata/RHSA-2026:50222https://access.redhat.com/errata/RHSA-2026:50223https://access.redhat.com/errata/RHSA-2026:50263https://access.redhat.com/security/cve/CVE-2026-12515https://bugzilla.redhat.com/show_bug.cgi?id=2489812https://github.com/Katello/katello/pull/11712