Red Hat Security Advisory

RHSA-2026:22326

Satellite 6.19.1 Async Update

Released 2026-06-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Satellite 6.19 for RHEL 9 dynflow-utils-2.0.1-1.el9sat, rubygem-katello-4.20.0.4-1.el9sat

Fixes 2 records

TI-2026-24811 CVE-2026-32282 · GHSA-xj38-jxc5-rppx

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

LOW 30

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00297 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-59

TI-2026-03763 CVE-2026-4324 · GHSA-fwj4-6wgp-mpxm

Rubygem-katello: katello: denial of service and potential information disclosure via sql injection

LOW 24

A flaw was found in the Katello plugin for Red Hat Satellite.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00278 Published 2026-03-17 Fixed in 3.14.0.14-1.el9sat, 0.1.23-0.3.el9pc +13 CWE-89