IT SBIT Services
Schneeberger
DEEN
CVE tracker

Red Hat Satellite Candlepin: Broken object-level authorization in REST API

CVE-2026-106471High 8.1

← All vulnerabilities

Summary

A flaw in the Candlepin subscription-management component of Red Hat Satellite lets an authenticated low-privilege user bypass authorization checks on multi-object API endpoints. Once the attacker can access the first referenced object, subsequent objects are not properly checked, so consumer data can be read and entitlements or activation keys can be modified, potentially across organizations. Exploitation requires knowledge of target resource identifiers such as consumer UUIDs, pool IDs or certificate serials, which are normally not visible across organizations. Red Hat rates the issue as Important, and the impact is highest in multi-tenant deployments.

Affected

  • Red Hat Satellite 6 (Candlepin component), per Red Hat's CVE record: status "Affected"
  • Affected version range: Unknown.

Fixed in

  • Unknown. No fixed build has been published as of the research date.
  • Satellite 6.19.0 and 6.18.6 ship Candlepin builds, but their errata do not list this CVE and must not be treated as fixes.

Workaround

  • Restrict Candlepin REST API access to trusted administrators where feasible until a fixed Candlepin build is deployed.
  • Limit which principals can obtain consumer client certificates or manage activation keys.
  • Review low-privilege accounts that can reach Candlepin-backed objects and restrict them (own recommendation, not a vendor statement).

Exploitation

  • No known exploitation reported in the sources checked.
  • Not listed in CISA KEV in the sources checked.
  • No public proof-of-concept found.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

  • Check whether Satellite or standalone Candlepin is deployed and whether its API or web UI is reachable from outside the network.
  • Restrict API access and certificate and activation key management to trusted administrators now.
  • Check the Red Hat CVE page and Bugzilla for the fixed Satellite version, then patch promptly.
  • Monitor for unusual API access and changes to entitlements or consumers.
  • Priority is high if Satellite is exposed or has many user accounts, lower if it is internal, single-organization and tightly controlled.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:37.

Original description (NVD)

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed