RHSA-2026:92667
Vulnerability from csaf_redhat - Published: 2026-10-29 17:55 - Updated: 2026-10-30 18:45Summary
Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
Severity
Critical
Notes
Topic: A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
Details: Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Model Context Protocol (MCP) Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly sending requests to accumulate unreleased session entries in memory, ultimately causing a Denial of Service (DoS) due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security (TLS) certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated encoding standard, Internationalizing Domain Names in Applications (IDNA) 2003 instead of IDNA 2008. If network traffic is redirected or intercepted, an attacker can present a legitimate certificate for the mismatched domain name, allowing them to impersonate the intended server and intercept or alter sensitive communications.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Moderate
A flaw was found in authlib. This flaw allows a remote attacker to bypass digital signature verification and submit forged data. When processing a JSON Web Signature (JWS, a format used to verify data integrity), the deserialize_json() function marks payloads as successfully verified without validating cryptographic signatures or requiring a verification key. Consequently, an attacker can supply manipulated data that the application treats as authentic and trusted, potentially leading to unauthorized access.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set (JWKS) endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an untrusted server, allowing the client to accept forged verification keys or potentially exposing sensitive credentials.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared secret key, allowing a remote attacker to forge valid authentication tokens and bypass security controls.
9.1 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Critical
A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key (JWK) parser fails to normalize Unicode byte-order marks (BOM). In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to misidentify the public key as a shared symmetric secret. This flaw allows an attacker to forge authenticated JSON Web Tokens (JWT) and bypass authentication controls.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens (JWTs). When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key (JWK) container representations, mistakenly accepting public key material as a symmetric Hash-based Message Authentication Code (HMAC) secret. As a result, an attacker with knowledge of the public key can generate validly signed tokens with arbitrary authenticated claims.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in joserfc. When processing a JSON Web Signature (JWS) in General JSON Serialization format, the library improperly treats tokens containing an empty signatures list as valid. A remote attacker without a valid signing key can exploit this flaw by submitting an arbitrary payload with an empty signatures array, bypassing signature verification and causing applications to treat untrusted data as authentic.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in mcp. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by exhausting system memory. Affected HTTP endpoints buffer incoming request bodies in memory without enforcing a maximum size limit. By sending excessively large or streamed request bodies, an attacker can consume significant process memory and terminate the server.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in dnspython. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted Domain Name System (DNS) message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed messages leads to excessive CPU utilization and application unresponsiveness.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in Authlib. When verifying JSON Web Tokens (JWT), the library fails to properly recognize asymmetric public keys that contain leading whitespace, comments, or formatting prefixes. An unauthenticated remote attacker who knows the public key can exploit this flaw to forge symmetric tokens using that public key as a secret. This allows the attacker to bypass authentication and gain unauthorized access with arbitrary identity or privileges.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in Authlib. The library improperly accepts zero-length key material during Hash-based Message Authentication Code (HMAC) signing and verification. If a host application verifies tokens using a secret that evaluates to an empty value, a remote attacker can generate predictable signatures for arbitrary token claims. This allows the attacker to forge authentic-looking tokens and bypass authentication controls.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
A flaw was found in Authlib. An authenticated remote attacker can bypass authorization controls to access, modify, or delete configurations belonging to other clients. In deployments implementing the documented reference code for dynamic client configuration, the server validates client editability without confirming that the presented registration access token belongs to the target client. Consequently, an attacker possessing any valid registration token can alter client settings to intercept authorization tokens or delete registrations, causing a denial of service.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-59951
Threats
Impact
Important
References
131 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:92667",
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102267",
"url": "https://access.redhat.com/security/cve/CVE-2026-102267"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102268",
"url": "https://access.redhat.com/security/cve/CVE-2026-102268"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102272",
"url": "https://access.redhat.com/security/cve/CVE-2026-102272"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102273",
"url": "https://access.redhat.com/security/cve/CVE-2026-102273"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-102946",
"url": "https://access.redhat.com/security/cve/CVE-2026-102946"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-109527",
"url": "https://access.redhat.com/security/cve/CVE-2026-109527"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114605",
"url": "https://access.redhat.com/security/cve/CVE-2026-114605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114615",
"url": "https://access.redhat.com/security/cve/CVE-2026-114615"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-114616",
"url": "https://access.redhat.com/security/cve/CVE-2026-114616"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116672",
"url": "https://access.redhat.com/security/cve/CVE-2026-116672"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59951",
"url": "https://access.redhat.com/security/cve/CVE-2026-59951"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63374",
"url": "https://access.redhat.com/security/cve/CVE-2026-63374"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96760",
"url": "https://access.redhat.com/security/cve/CVE-2026-96760"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-97687",
"url": "https://access.redhat.com/security/cve/CVE-2026-97687"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-97689",
"url": "https://access.redhat.com/security/cve/CVE-2026-97689"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92667.json"
}
],
"title": "Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview",
"tracking": {
"current_release_date": "2026-10-30T18:45:19+00:00",
"generator": {
"date": "2026-10-30T18:45:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:92667",
"initial_release_date": "2026-10-29T17:55:20+00:00",
"revision_history": [
{
"date": "2026-10-29T17:55:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-29T17:55:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T18:45:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.18",
"product": {
"name": "Red Hat Satellite 6.18",
"product_id": "Red Hat Satellite 6.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64",
"product": {
"name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64",
"product_id": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64",
"product_identification_helper": {
"purl": "pkg:oci/foreman-mcp-server-rhel9@sha256%3A64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490?arch=amd64\u0026repository_url=registry.redhat.io/satellite/foreman-mcp-server-rhel9\u0026tag=1793272276"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64 as a component of Red Hat Satellite 6.18",
"product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
},
"product_reference": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-59951",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-10-14T17:35:09.475312+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552683"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Model Context Protocol (MCP) Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly sending requests to accumulate unreleased session entries in memory, ultimately causing a Denial of Service (DoS) due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mcp: mcp: Denial of Service via session memory exhaustion in streamable HTTP servers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Important because unauthenticated remote attackers can exhaust host memory and cause an application-level denial of service without requiring user interaction or specialized privileges. Within Red Hat AI, Lightspeed, and automation offerings that incorporate Model Context Protocol (MCP) services, exposure occurs when servers are configured to listen on network-accessible, stateful Streamable HTTP endpoints. Deployments operating with stateless HTTP configurations, standard I/O (stdio), or Server-Sent Events (SSE) transports are not vulnerable to this session buildup.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59951"
},
{
"category": "external",
"summary": "RHBZ#2552683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552683"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59951"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59951",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59951"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7",
"url": "https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b",
"url": "https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/pull/3395",
"url": "https://github.com/modelcontextprotocol/python-sdk/pull/3395"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/pull/3426",
"url": "https://github.com/modelcontextprotocol/python-sdk/pull/3426"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0",
"url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0",
"url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv",
"url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv"
}
],
"release_date": "2026-10-14T16:22:31.653000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mcp: mcp: Denial of Service via session memory exhaustion in streamable HTTP servers"
},
{
"cve": "CVE-2026-63374",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-22T21:49:20.725016+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538958"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security (TLS) certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated encoding standard, Internationalizing Domain Names in Applications (IDNA) 2003 instead of IDNA 2008. If network traffic is redirected or intercepted, an attacker can present a legitimate certificate for the mismatched domain name, allowing them to impersonate the intended server and intercept or alter sensitive communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate severity for Red Hat products because exploitation requires an attacker to already be positioned to intercept network traffic, and the flaw only manifests when connecting to internationalized domain names containing non-ASCII characters. Within Red Hat supported environments and containerized AI components, workloads predominantly communicate using standard ASCII fully qualified domain names and internal endpoints. Because the defect does not allow remote code execution and requires a prior man-in-the-middle condition, the overall blast radius is constrained to specific redirected sessions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63374"
},
{
"category": "external",
"summary": "RHBZ#2538958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538958"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63374"
},
{
"category": "external",
"summary": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce",
"url": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"
},
{
"category": "external",
"summary": "https://github.com/agronholm/anyio/pull/1208",
"url": "https://github.com/agronholm/anyio/pull/1208"
},
{
"category": "external",
"summary": "https://github.com/agronholm/anyio/releases/tag/4.14.2",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
},
{
"category": "external",
"summary": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"
}
],
"release_date": "2026-09-22T15:23:14.259000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding"
},
{
"cve": "CVE-2026-96760",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-09-28T19:51:04.176894+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542633"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in authlib. This flaw allows a remote attacker to bypass digital signature verification and submit forged data. When processing a JSON Web Signature (JWS, a format used to verify data integrity), the deserialize_json() function marks payloads as successfully verified without validating cryptographic signatures or requiring a verification key. Consequently, an attacker can supply manipulated data that the application treats as authentic and trusted, potentially leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: authlib: Signature verification bypass via deserialize_json",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact for Red Hat products because an unauthenticated remote attacker could bypass cryptographic signature verification and submit forged token data. Successful exploitation directly compromises identity and integrity assurances when an application processes JSON-formatted web signatures. Exposure is primarily restricted to workloads where integrated services explicitly invoke the vulnerable JSON deserialization routine rather than standard compact tokens.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96760"
},
{
"category": "external",
"summary": "RHBZ#2542633",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542633"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96760"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96760",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96760"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib",
"url": "https://github.com/authlib/authlib"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/762428",
"url": "https://kb.cert.org/vuls/id/762428"
}
],
"release_date": "2026-09-28T19:37:58.973000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: authlib: Signature verification bypass via deserialize_json"
},
{
"cve": "CVE-2026-97687",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-29T15:44:25.449046+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy\u0027s TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having an Important impact because a network attacker can exploit corrupted TLS validation states to impersonate an HTTPS proxy, enabling complete interception and manipulation of sensitive communications as well as client credential theft. Successful exploitation depends on specialized application architectures where outgoing requests utilize an HTTPS-capable proxy alongside customized destination TLS parameters that inadvertently override proxy verification. Default Red Hat enterprise deployments that communicate directly with endpoints, utilize traditional HTTP proxies, or rely on standard CONNECT tunneling for end-to-end encryption do not expose this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97687"
},
{
"category": "external",
"summary": "RHBZ#2543255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97687"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465",
"url": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3",
"url": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/pull/5093",
"url": "https://github.com/urllib3/urllib3/pull/5093"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
"url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"
}
],
"release_date": "2026-09-29T15:30:27.136000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override"
},
{
"cve": "CVE-2026-97689",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-29T15:41:38.807723+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3. This flaw allows a Denial of Service (DoS) through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because an untrusted remote server can trigger process crashes and complete denial of service across client applications without requiring authentication or special privileges. In Red Hat environments, urllib3 is integrated across numerous system tools, container workloads, and platform services to handle outbound web communication. The risk specifically manifests when these services process streamed replies from potentially malicious third-party endpoints, whereas workloads restricted to internal or verified infrastructure remain largely unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97689"
},
{
"category": "external",
"summary": "RHBZ#2543245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97689"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97689"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed",
"url": "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/releases/tag/2.8.0",
"url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"
}
],
"release_date": "2026-09-29T15:36:05.963000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser"
},
{
"cve": "CVE-2026-102267",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-09-28T20:42:16.576688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set (JWKS) endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an untrusted server, allowing the client to accept forged verification keys or potentially exposing sensitive credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because improper handling of HTTP redirects during dynamic key retrieval can allow an adversary to supply forged cryptographic keys or intercept sensitive request headers. In Red Hat environments where services utilize PyJWKClient to fetch JSON Web Key Sets over the network, accepting untrusted key material may compromise token validation and authentication boundaries. Exploitation requires the target service to dynamically resolve keys via HTTP and relies on an attacker\u0027s ability to manipulate responses returned by the configured key server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102267"
},
{
"category": "external",
"summary": "RHBZ#2542690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102267"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102267",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102267"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56",
"url": "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
"url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj"
}
],
"release_date": "2026-09-28T20:23:33.556000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects"
},
{
"cve": "CVE-2026-102268",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-09-28T20:40:56.952621+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared secret key, allowing a remote attacker to forge valid authentication tokens and bypass security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity for Red Hat products because an unauthenticated remote attacker could forge valid cryptographic tokens and bypass authentication checks without knowing the private signing key. Exploitation occurs when consuming applications configure token verification to accept both symmetric and asymmetric algorithms simultaneously, allowing an asymmetric public key to be mishandled as a symmetric secret. Deployments that strictly enforce a single algorithm type or validate tokens using JSON Web Key sets do not permit this algorithm confusion and remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102268"
},
{
"category": "external",
"summary": "RHBZ#2542685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102268"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102268",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102268"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07",
"url": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
"url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9"
}
],
"release_date": "2026-09-28T20:26:13.674000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "pyjwt: PyJWT: Authentication bypass via improper public key validation"
},
{
"cve": "CVE-2026-102272",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-09-28T20:51:42.409127+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542695"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key (JWK) parser fails to normalize Unicode byte-order marks (BOM). In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to misidentify the public key as a shared symmetric secret. This flaw allows an attacker to forge authenticated JSON Web Tokens (JWT) and bypass authentication controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because successful exploitation permits an unauthenticated remote attacker to bypass authentication and forge valid tokens, though exploitation requires specific mixed-algorithm verification settings. In Red Hat environments, exposure is restricted to services that simultaneously allow both symmetric HMAC and asymmetric signature algorithms while parsing public keys that contain byte order marks. Workloads and services that enforce single-algorithm verification policies or utilize standard asymmetric key validation routines are not susceptible to this attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102272"
},
{
"category": "external",
"summary": "RHBZ#2542695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102272"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291",
"url": "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
"url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"
}
],
"release_date": "2026-09-28T20:36:31.530000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling"
},
{
"cve": "CVE-2026-102273",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-09-28T20:52:12.127939+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542697"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens (JWTs). When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key (JWK) container representations, mistakenly accepting public key material as a symmetric Hash-based Message Authentication Code (HMAC) secret. As a result, an attacker with knowledge of the public key can generate validly signed tokens with arbitrary authenticated claims.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an attacker with access to a public verification key can forge cryptographic tokens to bypass authentication, allowing impersonation of privileged users and unauthorized access to protected application resources. Exploitation is limited to environments where applications concurrently permit symmetric HMAC and asymmetric algorithms while passing public key containers into validation routines.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102273"
},
{
"category": "external",
"summary": "RHBZ#2542697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542697"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102273"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102273",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102273"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95",
"url": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
"url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"
}
],
"release_date": "2026-09-28T20:38:28.161000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets"
},
{
"cve": "CVE-2026-102946",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-10-15T18:41:28.779791+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553667"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in joserfc. When processing a JSON Web Signature (JWS) in General JSON Serialization format, the library improperly treats tokens containing an empty signatures list as valid. A remote attacker without a valid signing key can exploit this flaw by submitting an arbitrary payload with an empty signatures array, bypassing signature verification and causing applications to treat untrusted data as authentic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "joserfc: joserfc: Signature verification bypass via empty signatures array",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Critical impact because it permits an unauthenticated remote attacker to completely bypass cryptographic verification without possessing valid signing keys, compromising data integrity and trust. By presenting crafted objects omitting cryptographic signatures, callers parsing general serializations mistakenly treat fabricated payloads as authentic. Exposure is limited to application workflows utilizing the general JSON serialization mechanism, while standard compact token decodings such as JSON Web Tokens (JWT) are not susceptible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102946"
},
{
"category": "external",
"summary": "RHBZ#2553667",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553667"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102946"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102946",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102946"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe",
"url": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/releases/tag/1.7.4",
"url": "https://github.com/authlib/joserfc/releases/tag/1.7.4"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2",
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"
}
],
"release_date": "2026-10-15T18:28:06.913000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "joserfc: joserfc: Signature verification bypass via empty signatures array"
},
{
"cve": "CVE-2026-109527",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-14T18:02:50.560114+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2552745"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mcp. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by exhausting system memory. Affected HTTP endpoints buffer incoming request bodies in memory without enforcing a maximum size limit. By sending excessively large or streamed request bodies, an attacker can consume significant process memory and terminate the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mcp: mcp: Denial of Service via unbounded HTTP request body buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having an Important severity impact because unauthenticated remote attackers can exhaust system memory and terminate service processes without requiring authentication or user interaction. The issue specifically threatens deployments that expose Model Context Protocol HTTP, Server-Sent Events (SSE), or OAuth routes to untrusted networks. Systems operating solely with standard input/output transports or running behind protective reverse proxies that restrict request body sizes are not susceptible to this exhaustion condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-109527"
},
{
"category": "external",
"summary": "RHBZ#2552745",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552745"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-109527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109527"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/commit/03aaebd3aadb2567878dd811cb1f141454e8a080",
"url": "https://github.com/modelcontextprotocol/python-sdk/commit/03aaebd3aadb2567878dd811cb1f141454e8a080"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c",
"url": "https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb",
"url": "https://github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189",
"url": "https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.29.1",
"url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.29.1"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.0",
"url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.0"
},
{
"category": "external",
"summary": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc",
"url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc"
}
],
"release_date": "2026-10-14T17:52:35.943000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mcp: mcp: Denial of Service via unbounded HTTP request body buffering"
},
{
"cve": "CVE-2026-114605",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-10-22T16:42:27.165994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559128"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dnspython. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted Domain Name System (DNS) message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed messages leads to excessive CPU utilization and application unresponsiveness.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because an unauthenticated remote attacker can trigger complete CPU exhaustion and application unresponsiveness without requiring specialized access or privileges. In Red Hat enterprise deployments, the library is embedded across multiple platform services and containerized environments that process network records. Systems are primarily vulnerable when applications accept and decompress wire-format responses from untrusted external name servers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114605"
},
{
"category": "external",
"summary": "RHBZ#2559128",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559128"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114605"
},
{
"category": "external",
"summary": "https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023",
"url": "https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023"
},
{
"category": "external",
"summary": "https://github.com/rthalley/dnspython/releases/tag/v2.9.0",
"url": "https://github.com/rthalley/dnspython/releases/tag/v2.9.0"
},
{
"category": "external",
"summary": "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m",
"url": "https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"
}
],
"release_date": "2026-10-22T16:25:32.509000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal"
},
{
"cve": "CVE-2026-114615",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-10-22T21:32:58.415231+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559394"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib. When verifying JSON Web Tokens (JWT), the library fails to properly recognize asymmetric public keys that contain leading whitespace, comments, or formatting prefixes. An unauthenticated remote attacker who knows the public key can exploit this flaw to forge symmetric tokens using that public key as a secret. This allows the attacker to bypass authentication and gain unauthorized access with arbitrary identity or privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass via improper asymmetric key validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker could forge cryptographic tokens and bypass authentication, leading to unauthorized access. The issue stems from incomplete validation of asymmetric key prefixes, which permits public keys with non-canonical formatting to be treated as symmetric secrets when mixed algorithm registries are enabled. In Red Hat environments, overall exposure is constrained to services that permit dynamic algorithm selection alongside non-stripped public key configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114615"
},
{
"category": "external",
"summary": "RHBZ#2559394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559394"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114615"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114615",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114615"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf",
"url": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/pull/945",
"url": "https://github.com/authlib/authlib/pull/945"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
"url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-7vr2-2fgp-9w7p",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-7vr2-2fgp-9w7p"
}
],
"release_date": "2026-10-22T21:10:02.023000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: Authlib: Authentication bypass via improper asymmetric key validation"
},
{
"cve": "CVE-2026-114616",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-10-22T21:33:10.831873+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib. The library improperly accepts zero-length key material during Hash-based Message Authentication Code (HMAC) signing and verification. If a host application verifies tokens using a secret that evaluates to an empty value, a remote attacker can generate predictable signatures for arbitrary token claims. This allows the attacker to forge authentic-looking tokens and bypass authentication controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: authlib: Authentication bypass via zero-length HMAC key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because successful exploitation enables remote unauthenticated token forgery and full authentication bypass, though the risk is constrained by the prerequisite that the consuming service must resolve HMAC secrets to empty values. In standard Red Hat deployments, underlying services and containerized offerings enforce or dynamically provision defined secret keys, substantially reducing exposure under default configurations. However, if an application environment fails to supply a secret or allows key lookups to return blank values, external actors can generate predictable signatures and gain unauthorized access.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114616"
},
{
"category": "external",
"summary": "RHBZ#2559395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114616"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114616",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114616"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b",
"url": "https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.9.1",
"url": "https://github.com/authlib/authlib/releases/tag/v1.9.1"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg"
}
],
"release_date": "2026-10-22T21:14:03.060000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: authlib: Authentication bypass via zero-length HMAC key"
},
{
"cve": "CVE-2026-116672",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-10-27T18:14:34.299719+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2562188"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib. An authenticated remote attacker can bypass authorization controls to access, modify, or delete configurations belonging to other clients. In deployments implementing the documented reference code for dynamic client configuration, the server validates client editability without confirming that the presented registration access token belongs to the target client. Consequently, an attacker possessing any valid registration token can alter client settings to intercept authorization tokens or delete registrations, causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: authlib: Authorization bypass via missing client token verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an authenticated entity holding a valid registration token could modify or delete client registrations belonging to other tenants, compromising OAuth client configurations and potentially intercepting authorization credentials. Within Red Hat environments, Authlib is predominantly utilized for client-side OAuth and OpenID Connect flows rather than hosting Dynamic Client Registration Management endpoints. Consequently, the flaw is only exploitable in environments operating custom OAuth authorization servers that explicitly expose the RFC 7592 client configuration endpoint based on the flawed reference implementation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116672"
},
{
"category": "external",
"summary": "RHBZ#2562188",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562188"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116672"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116672",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116672"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff",
"url": "https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.9.1",
"url": "https://github.com/authlib/authlib/releases/tag/v1.9.1"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v"
}
],
"release_date": "2026-10-27T16:31:48.429000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T17:55:20+00:00",
"details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92667"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: authlib: Authorization bypass via missing client token verification"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.