Database/Firmware, BMC & network fabric
Red Hat Satellite: crafted BMC username in the rubyipmi gem leads to code execution
Impact
Satellite's BMC integration passes the host's BMC username through the rubyipmi gem in a way that lets an authenticated user with host create or update rights achieve remote code execution on the Satellite server. Satellite is the provisioning and lifecycle brain for a fleet: it holds subscription credentials, kickstart content, and out-of-band power and console access to every registered machine. Code execution there hands an attacker the ability to reprovision or power-cycle GPU nodes, which is the one operation an operator cannot absorb cheaply on a busy cluster.
Who can reach it
Authenticated Satellite user holding host creation or update permissions, via the Satellite web UI or API. Not reachable unauthenticated.
What to do
Apply the Satellite errata for your version - RHSA-2026:5968, RHSA-2026:5970 or RHSA-2026:5971 cover Satellite 6.16 on RHEL 8/9 and 6.17/6.18 on RHEL 9 - and restart Satellite services. Managed nodes need no change. Review who holds host-edit permissions, and audit BMC credentials stored in Satellite if the server may have been reached.
References
Related entries
- Dell OpenManage Integration for Windows Admin Center: OS command injection by a low-privilege remote userCVE-2026-101207 · Dell OpenManage Integration for Microsoft Windows Admin CenterHigh
- Junos OS Evolved jti-dialoutd: crafted sensor resource causes persistent telemetry dial-out outageCVE-2026-101966 · Juniper Junos OS Evolved jti-dialoutd (telemetry dial-out via gNMI listener)High
- Lenovo XClarity Integrator for Windows Admin Center (PowerShell command injection): PowerShell command injectionCVE-2026-14371 · Lenovo XClarity Integrator for Windows Admin Center (PowerShell command injection)High
- OpenBMC phosphor-net-ipmid: session authorization can be swapped to another account without re-authenticatingCVE-2026-16140 · OpenBMC phosphor-net-ipmid (IPMI 2.0 RAKP session authorization)High
- Lenovo XClarity Orchestrator (OS command injection): An authenticated attacker executes arbitrary OS commandsCVE-2026-16793 · Lenovo XClarity Orchestrator (OS command injection)High
- Eaton Tripp Lite series PADM firmware, session management interface: A low-privilege authenticated user escalatesCVE-2026-22622 · Eaton Tripp Lite series PADM firmware, session management interfaceHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.