CVE-2026-107360: Red Hat Satellite Template Sandbox Bypass Fixed in rubygem-safemode 1.5.0-3

TL;DR

Red Hat published 21 new CVEs on November 12, 2026, and the most severe scores 9.6. That flaw, CVE-2026-107360, leads a group of seven Red Hat Satellite vulnerabilities. The rest affect Red Hat Enterprise Linux (RHEL) packages and Ansible Automation Platform (AAP).

A critical sandbox bypass in Satellite’s template engine lets an authenticated user run unapproved methods, including host deletion. Satellite errata fix five of the seven Satellite flaws. Red Hat lists no exploitation for any of the 21 CVEs, and none appear in CISA’s KEV catalog.

Notable CVEs

Why It Matters

Satellite manages patching and provisioning for whole fleets of RHEL hosts. As a result, a flaw in Satellite can reach every host it manages. Several of these bugs expose root passwords, access tokens or SSH access to managed machines.

How the Attack Works

Red Hat Satellite

CVE-2026-107360 sits in rubygem-safemode, the sandbox that renders templates. According to the Red Hat CVE page, compound assignment expressions skip the Jail allow-list. An attacker who can edit template content can then call methods the sandbox should block.

Four other Red Hat Satellite vulnerabilities are authorization gaps in Foreman’s API. CVE-2026-86322 (CVSS 8.8) lets a user create a personal access token for another account. Similarly, CVE-2026-86324 lets an attacker add their own SSH key to another user’s account. Meanwhile, CVE-2026-107443 exposes rendered templates, including host root passwords, to view-only users. Red Hat calls it an incomplete fix of CVE-2026-96659.

Two more bugs hit Satellite components. In Candlepin, CVE-2026-111456 lets a consumer register itself in another organization. In smart_proxy_dynflow, CVE-2026-107152 lets a certificate holder read job details, including any passwords passed to jobs.

RHEL Packages

CVE-2026-18379 (8.8) is a path traversal in yggdrasil-worker-package-manager on RHEL 10. A crafted repository name makes a root process write or delete files elsewhere. In addition, CVE-2026-121876 lets a malicious host inject a swap partition into confidential VMs, which can expose TEE-protected memory.

Two FreeRADIUS overflows, in EAP-FAST and EAP-SIM, let remote attackers crash the server without logging in. The rest are denial-of-service bugs in SSSD and cpio.

Ansible Automation Platform

The six AAP flaws include an unauthenticated debug endpoint in AWX (CVE-2026-71363). Others cover a secret stored in cleartext, missed host-key changes in ansible-pylibssh, and cross-organization data leaks.

Affected Versions

• Satellite 6.16, 6.17 and 6.18 (rubygem-safemode, Foreman, Candlepin, smart_proxy_dynflow)
• RHEL 6 through 10, depending on the package
• Ansible Automation Platform 2.4 to 2.7 components

Patch and Mitigation

Red Hat errata RHSA-2026:99949, 99950 and 99952 cover five Satellite flaws. The fixed builds include rubygem-safemode 1.5.0-3 and Foreman 3.12.0.26, 3.14.0.26 or 3.16.0.29, depending on the Satellite release. RHSA-2026:96082 fixes the yggdrasil flaw on RHEL 10.

However, the record lists no errata yet for CVE-2026-86324, CVE-2026-86323 or the remaining RHEL and AAP flaws. Until fixes ship, restrict template editing and token permissions to trusted admins. In short, patch Red Hat Satellite vulnerabilities first, then watch for RHEL and AAP updates.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.