CVE-2020-1693: Red Hat Spacewalk

Critical severity, CVSS 9.8. EPSS: 4.3% chance of exploitation in the next 30 days.

A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.

Affected products

• Red Hat Spacewalk: before 2.9 (fixed in 2.9)

Published 2020-02-17. Last modified 2026-06-17.