CVE-2026-12515: Red Hat Satellite Information Disclosure

CVE-2026-12515 Overview

CVE-2026-12515 is a missing authorization vulnerability [CWE-862] in Katello, the content management component of Red Hat Satellite. The flaw resides in the ContentUploadsController, where insufficient authorization checks allow authenticated users holding the edit_products permission to query content information for repositories outside their authorized product scope. An attacker can determine whether specific content exists within repositories that should remain inaccessible. The issue does not permit modification, import, or publication of content, limiting the impact to information disclosure.

Critical Impact
Authenticated users with edit_products permission can enumerate content existence in unauthorized repositories, exposing information about isolated product lines or tenant-managed content within shared Satellite deployments.

Affected Products

Red Hat Satellite (Katello component)
Katello upstream project
Deployments exposing the ContentUploadsController API endpoint

Discovery Timeline

2026-06-17 - CVE-2026-12515 published to the National Vulnerability Database
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-12515

Vulnerability Analysis

The vulnerability is a broken access control issue in Katello's ContentUploadsController. Katello manages content repositories grouped under products, and Role-Based Access Control (RBAC) is supposed to constrain user actions to authorized products. The controller responsible for content upload queries fails to verify that the repository targeted by a request belongs to a product the requester is authorized to manage. A user granted the edit_products permission for one product can therefore send queries referencing repositories owned by other products. The server processes the request and returns content existence information, enabling cross-product reconnaissance. The flaw is limited to read-style probing — write operations such as uploading, importing, or publishing content remain blocked by other access checks.

Root Cause

The root cause is a missing authorization check between the authenticated session context and the repository identifier supplied in the request. The ContentUploadsController confirms that the caller holds the edit_products capability but does not validate ownership of the specific repository referenced in the query. This is a classic CWE-862 (Missing Authorization) pattern, where coarse-grained permission checks substitute for per-object authorization.

Attack Vector

Exploitation requires network access to the Satellite web interface or API and valid credentials with the edit_products permission. The attacker issues an authenticated request to the content uploads endpoint, supplying a repository identifier outside their authorized product scope. The server's response reveals whether the referenced content exists in the target repository. No user interaction is required, and the attack complexity is low. Because no verified public proof-of-concept code is available, defenders should reference the Red Hat CVE-2026-12515 Advisory and the GitHub Pull Request #11712 for the upstream fix details.

Detection Methods for CVE-2026-12515

Indicators of Compromise

Authenticated requests to ContentUploadsController endpoints referencing repository IDs outside the requester's assigned organization or product scope.
High volume of content existence queries from a single user account spanning many repository identifiers.
Audit log entries showing edit_products users interacting with repositories they have never previously accessed.

Detection Strategies

Correlate Satellite audit logs against the RBAC role assignments to identify queries crossing product boundaries.
Monitor API access logs for sequential or scripted enumeration patterns against /katello/api/repositories/*/content_uploads style endpoints.
Baseline normal edit_products user behavior and alert on deviation in repository scope coverage.

Monitoring Recommendations

Forward Satellite and Apache or NGINX access logs to a central SIEM with user-to-organization mapping enriched at ingestion.
Enable Katello audit logging at a verbosity that captures repository identifiers in content upload calls.
Review role assignments quarterly to confirm the edit_products permission is granted only where required.

How to Mitigate CVE-2026-12515

Immediate Actions Required

Apply the upstream Katello patch tracked in GitHub Pull Request #11712 once available through your Red Hat Satellite channel.
Audit users currently holding the edit_products permission and revoke it from accounts that do not require product editing rights.
Review Satellite audit logs for prior cross-product content queries that may indicate reconnaissance activity.

Patch Information

Red Hat tracks the issue in Red Hat Bug Report #2489812 and the Red Hat CVE-2026-12515 Advisory. The upstream Katello fix adds repository-level authorization enforcement in the ContentUploadsController so that operations are validated against the product owning the target repository. Administrators should subscribe to Red Hat Satellite errata and apply the corresponding Satellite update when published.

Workarounds

Restrict the edit_products permission to a minimum set of trusted accounts until the patch is applied.
Segregate sensitive product content into separate Satellite organizations so RBAC organization boundaries provide an additional control layer.
Place the Satellite management interface behind network segmentation and limit access to administrative subnets only.

bash

# Configuration example: identify users currently granted edit_products
hammer user list --search 'role = "edit_products"'
hammer role filter list --role 'Custom Product Editor' \
  | grep -i edit_products