CVE-2026-9073 Details

A vulnerability exists in the Foreman MCP Server component of Red Hat Satellite 6, specifically in the 'satellite/foreman-mcp-server-rhel9' package. This vulnerability arises from two logging mechanisms that improperly handle sensitive session and authentication information. By default, the server logs session identifiers, which are considered authentication credentials, at an informational level. Additionally, when debug logging is activated, HTTP request headers are inadequately sanitized, resulting in the cleartext logging of sensitive data such as authorization tokens and API keys. This flaw can lead to a confidentiality breach, as the exposed authentication data is stored in plain text within container logs, posing a risk if these logs are sent to a centralized platform.

To mitigate this vulnerability, it is recommended to configure the application's logging settings to suppress the default informational logs that leak session IDs. This can be done by setting the 'mcp.server' logger to 'WARNING' or higher. Additionally, the logging middleware should be re-engineered to adopt a positive security model, ensuring that all sensitive header values are masked by default, while only allowing known non-sensitive headers.