RHSA-2026:92667CriticalCVSS 9.1

Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

Published
October 29, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (15)

CVE-2026-102272 →CVE-2026-114615 →CVE-2026-114616 →CVE-2026-97689 →CVE-2026-102273 →CVE-2026-114605 →CVE-2026-116672 →CVE-2026-97687 →CVE-2026-102267 →CVE-2026-102946 →CVE-2026-109527 →CVE-2026-59951 →CVE-2026-63374 →CVE-2026-96760 →CVE-2026-102268 →

📋 Description

CVE-2026-59951 — mcp: mcp: Denial of Service via session memory exhaustion in streamable HTTP servers CVE-2026-63374 — anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding CVE-2026-96760 — authlib: authlib: Signature verification bypass via deserialize_json CVE-2026-97687 — urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override CVE-2026-97689 — urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-102946 — joserfc: joserfc: Signature verification bypass via empty signatures array CVE-2026-109527 — mcp: mcp: Denial of Service via unbounded HTTP request body buffering CVE-2026-114605 — dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal CVE-2026-114615 — authlib: Authlib: Authentication bypass via improper asymmetric key validation CVE-2026-114616 — authlib: authlib: Authentication bypass via zero-length HMAC key CVE-2026-116672 — authlib: authlib: Authorization bypass via missing client token verification

🎯 Affected products2

  • Red Hat Satellite 6.18
  • registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:64b212ced97ae78ea18b3105b5c14d626229958b6a0f100d2ab7c3b593632490_amd64 as a component of Red Hat Satellite 6.18

✅ Remediation

For Satellite MCP integration see the Red Hat Satellite documentation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (20)