Advisory · CVE-2026-106471
Authorization bypass in Red Hat Satellite's Candlepin lets attackers cross organizations
Candlepin in Red Hat Satellite 6 grants access when any one of several checked parameters is authorized instead of requiring all of them, letting a low-privilege authenticated attacker read and modify subscription resources across organizations. Red Hat rates it high at CVSS 8.1.
- Vendor
- Red Hat
- Product
- Red Hat Satellite 6
- Identifier / CWE
- CVE-2026-106471
CWE-863 - Action timing
- Immediate
Explain it like I’m five
The gatekeeper is supposed to check three hall passes before letting someone into the vault. Instead it lets them in if any one pass looks valid. A junior employee with one real pass can walk into rooms they were never cleared for.
- 01Authenticated access
A low-privilege authenticated attacker holds valid access to one referenced object, such as their own consumer.
- 02Multi-object request
The attacker crafts a Candlepin API request referencing additional objects across organizations.
- 03Any-match authorization
The central authorization filter grants access because one @Verify-annotated parameter is accessible, skipping checks on the rest.
- 04Cross-org actions
The attacker reads consumer information and modifies entitlements and subscription resources belonging to other organizations.
What happened
Red Hat disclosed CVE-2026-106471 on October 7, 2026: an authorization flaw in Candlepin, the subscription management service inside Red Hat Satellite 6. The central authorization filter grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on the rest. Red Hat scores it high at CVSS 3.1 8.1, with confidentiality and integrity impacted.
When the attacker knows target resource identifiers (consumer UUIDs, entitlement IDs, pool IDs, certificate serials), this enables unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations. Red Hat notes those identifiers are not normally visible across organizations, which limits opportunistic exploitation but not targeted attacks.
Red Hat credits Xanlar Agamalizade with reporting the issue. At the time of writing, Red Hat’s mitigation guidance is to restrict Candlepin REST API access to trusted administrators where feasible until a fixed candlepin build is deployed, and to limit which principals can obtain consumer client certificates or manage activation keys.
What to do
- Identify Red Hat Satellite 6 installations and the Candlepin services behind them.
- Restrict Candlepin REST API access to trusted administrators until a fixed candlepin build is deployed.
- Limit which principals can obtain consumer client certificates or manage activation keys.
- Review Candlepin audit logs for API requests referencing objects across organizations, especially from low-privilege accounts.
- Check for unexpected entitlement changes, pool bindings, or activation key modifications, and revert or re-verify them.
Management note
This is a tenant-isolation failure in subscription management: one organization’s entitlements become readable and writable by another’s low-privilege users. The attack needs known identifiers, which slows random attackers but not anyone with a foothold or knowledge of your environment. Lock down the API surface now and treat the entitlement ledger as untrusted until audited.