Red Hat published 21 CVEs on November 12 across Satellite, RHEL packages and Ansible Automation Platform, led by CVE-2026-107360, a sandbox bypass in Red Hat Satellite rated CVSS 9.6. No exploitation has been reported, and none of the flaws is listed in the CISA Known Exploited Vulnerabilities catalog.
CVE-2026-107360: Sandbox Escape in rubygem-safemode
In rubygem-safemode, compound assignment expressions skip the Jail allow-list that restricts which methods templates may call. An authenticated template editor can use the gap to call blocked methods, such as deleting a host.
Satellite manages whole RHEL fleets, so a flaw that lets a template editor perform actions the sandbox forbids can reach every managed host.
Other Satellite Flaws Affecting Tokens, Keys and Passwords
Several other Satellite bugs concern access boundaries:
- CVE-2026-86322 (8.8) lets a user obtain a personal access token for another account.
- CVE-2026-86324 lets a user add their own SSH key to another user.
- CVE-2026-107443 lets view-only users see rendered templates, including host root passwords. It is an incomplete fix of CVE-2026-96659.
- CVE-2026-111456 allows cross-organization registration in Candlepin.
- CVE-2026-107152 lets smart_proxy_dynflow read job passwords.
Flaws Beyond Satellite in RHEL and Ansible
Outside Satellite, CVE-2026-18379 (8.8) is a path traversal in yggdrasil-worker-package-manager on RHEL 10. CVE-2026-121876 allows swap partition injection into confidential virtual machines. FreeRADIUS has overflows in EAP-FAST and EAP-SIM handling.
Six Ansible Automation Platform Fixes
Ansible Automation Platform receives six fixes, including CVE-2026-71363, an unauthenticated AWX debug endpoint. Of the set, that is the one reachable without credentials.
Red Hat Satellite Errata and Interim Mitigations
Red Hat issued errata RHSA-2026:99949, RHSA-2026:99950 and RHSA-2026:99952 for five Satellite flaws, shipping rubygem-safemode 1.5.0-3 and Foreman 3.12.0.26, 3.14.0.26 and 3.16.0.29. RHSA-2026:96082 covers another fix. Several CVEs have no errata yet.
Until errata arrive, Red Hat’s guidance is to restrict template editing and token permissions.
Why Management-Plane Flaws Concentrate Risk
Most of the Satellite flaws are authenticated, so the immediate exposure depends on how many people hold template-editing, token or view-only roles. The set shows a recurring pattern in management tooling: boundaries between roles, such as view-only users, template editors and users of other organizations, do not hold when one expression type or one API call slips past a check.
The incomplete fix behind CVE-2026-107443, which follows CVE-2026-96659, is a reminder to verify the status of earlier patches when reviewing this batch. Organizations that applied the earlier fix should confirm it against the new advisory.
Fleet-management systems carry an outsized share of the impact because they hold credentials for the machines they manage. Reading host root passwords or job passwords, as two of these flaws permit, gives an attacker a route from a low-privilege Satellite account to the systems underneath.
Priority Order for Satellite Administrators
The five Satellite flaws covered by the three Satellite errata share a theme: each lets one user act as another or see something they should not. Administrators who cannot patch immediately have two levers from Red Hat’s guidance, restricting who can edit templates and limiting token permissions. Those controls address the sandbox bypass in CVE-2026-107360 and the token-related flaw CVE-2026-86322 respectively.
Red Hat CVEs Still Awaiting Errata Releases
Several of the CVEs have no errata at publication, so the list of fixed packages will grow. Teams that track Red Hat advisories should check RHSA-2026:96082 and the three Satellite advisories first, then monitor for updates covering the CVEs that remain open, including the AWX debug endpoint.
Confidential VM and FreeRADIUS Findings
CVE-2026-121876, the swap partition injection into confidential virtual machines, is notable because those VMs exist to protect workloads from the host. The FreeRADIUS overflows in EAP-FAST and EAP-SIM handling affect authentication services, a different class of exposure from the Satellite role flaws, and they reflect the breadth of a 21-CVE batch that spans management software, kernel-adjacent packages and automation tooling.
