Critical Sandbox Bypass in Red Hat Satellite rubygem-safemode (CVE-2026-107360) Among 21 New Red Hat CVEs
On November 12, 2026, Red Hat disclosed 21 new vulnerabilities affecting multiple products including Red Hat Satellite, Red Hat Enterprise Linux (RHEL), and the Ansible Automation Platform (AAP). The most severe vulnerability, CVE-2026-107360, is a critical sandbox bypass in the rubygem-safemode component of Red Hat Satellite with a CVSSv3 score of 9.6. This flaw permits an authenticated user with template editing access to execute unauthorized methods, such as host deletion. Additional notable vulnerabilities include authorization bypasses in Foreman's API allowing unauthorized personal access token creation and SSH key insertion, exposure of sensitive root passwords to view-only users, and cross-organization data leaks in AAP components. To mitigate risks, Red Hat has released errata fixes for several Satellite vulnerabilities, including rubygem-safemode 1.5.0-3, Foreman updates, and fixes for the yggdrasil path traversal on RHEL 10. However, not all flaws currently have available patches. Red Hat has not reported any active exploitation, nor have these flaws appeared in CISA's KEV catalog. Satellite's role in managing fleets of RHEL hosts amplifies the potential impact of these vulnerabilities if exploited. Administrators are advised to apply the latest security updates promptly and restrict template editing and token permissions to trusted personnel until all patches are available.
Entenda a falha
A vulnerabilidade
CVE-2026-107360 (CVSSv3 9.6, critical) is a sandbox bypass in rubygem-safemode, the sandbox that renders templates in Red Hat Satellite 6.16, 6.17 and 6.18. An authenticated user who can edit template content can call methods the sandbox should block, such as deleting hosts. Fixed in rubygem-safemode 1.5.0-3. It leads 21 CVEs Red Hat published on November 12, 2026. Others in the Satellite group: CVE-2026-86322 (8.8), where a user can create a personal access token for another account; CVE-2026-86324, which lets an attacker add their own SSH key to another user's account; and CVE-2026-107443, where view-only users can see rendered templates including host root passwords (an incomplete fix of CVE-2026-96659). CVE-2026-111456 (Candlepin) and CVE-2026-107152 (smart_proxy_dynflow) are also covered. Outside Satellite: CVE-2026-18379 (8.8, yggdrasil path traversal on RHEL 10) and CVE-2026-121876 (swap injection in confidential VMs), plus CVE-2026-71363, an unauthenticated debug endpoint in AWX. Red Hat lists no exploitation and none of them are in CISA's KEV.
Como funciona
Satellite renders templates through rubygem-safemode, which runs template code inside a sandbox. The sandbox uses an allow-list, called the Jail, to decide which methods template code may call. When a user with template editing rights submits content containing compound assignment expressions, those expressions skip the Jail check. The sandbox therefore lets the template call methods that are not on the allow-list, for example ones that delete hosts. The articles do not give more detail on the internal flow.
Por que é vulnerável
According to the Red Hat CVE page cited by the article, the root cause is a missing check: compound assignment expressions are not validated against the Jail allow-list, so the sandbox's restriction does not apply to them. The fix ships in rubygem-safemode 1.5.0-3. The articles do not describe the code change or why the gap went unnoticed.
Como foi descoberta
The articles do not say who found the flaws or how. Red Hat disclosed the 21 CVEs on November 12, 2026, and says nothing about exploitation in the wild. CVE-2026-107443 is described by Red Hat as an incomplete fix of the earlier CVE-2026-96659.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 23:15.
Linha do tempo
-
Critical Sandbox Bypass in Red Hat Satellite rubygem-safemode (CVE-2026-107360) Among 21 New Red Hat CVEs
ler a análise desta fonte ocultar
On November 12, 2026, Red Hat disclosed 21 new vulnerabilities affecting multiple products including Red Hat Satellite, Red Hat Enterprise Linux (RHEL), and the Ansible Automation Platform (AAP). The most severe vulnerability, CVE-2026-107360, is a critical sandbox bypass in the rubygem-safemode component of Red Hat Satellite with a CVSSv3 score of 9.6. This flaw permits an authenticated user with template editing access to execute unauthorized methods, such as host deletion. Additional notable vulnerabilities include authorization bypasses in Foreman's API allowing unauthorized personal access token creation and SSH key insertion, exposure of sensitive root passwords to view-only users, and cross-organization data leaks in AAP components. To mitigate risks, Red Hat has released errata fixes for several Satellite vulnerabilities, including rubygem-safemode 1.5.0-3, Foreman updates, and fixes for the yggdrasil path traversal on RHEL 10. However, not all flaws currently have available patches. Red Hat has not reported any active exploitation, nor have these flaws appeared in CISA's KEV catalog. Satellite's role in managing fleets of RHEL hosts amplifies the potential impact of these vulnerabilities if exploited. Administrators are advised to apply the latest security updates promptly and restrict template editing and token permissions to trusted personnel until all patches are available.