CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1)
Katello Registry Proxy lets low-privilege users bypass authorization and enumerate organizations and products.
Katello fixed CVE-2026-56098, an authorization bypass in the Registry Proxy. An authenticated low-privilege user can skip authorization checks and enumerate organizations and products by observing response differences. Affected versions are Katello 4.13.0 through 4.21.1.1 and 5.0.0, with a CVSS 3.1 score of 4.3 (Moderate). Fixes are in Katello 4.21.2 and 5.0.1; exploitation in the wild is not reported.
- Low-privilege users can bypass Registry Proxy authorization checks.
- Response differences reveal organizations and products.
- CVSS 4.3 (Moderate): network, low privileges, confidentiality low.
- Affects Katello 4.13.0–4.21.1.1 and 5.0.0; fixed in 4.21.2 and 5.0.1.
Vulnerabilities mentionedAll →
- CVE-2026-560984.3—Authorization bypass in Katello registry proxypublished · Red Hat rubygem-katello (Katello)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-56098 | Authorization bypass in Katello registry proxy Katello’s RegistryProxiesController has an authorization-bypass flaw (CWE-203) in the registry_authorize filter. Unauthorized requests are detected and an error is started, but a missing return lets execution continue into later business-logic and database checks. Differential responses then leak internal state, so a low-privileged attacker can enumerate valid users, organizations, and products across the instance. Confidentiality impact is low (CVSS 3.1 4.3); integrity and availability are not affected. The issue is fixed in Katello 4.21.2 and 5.0.1, is not on the CISA KEV list, and no public proof-of-concept is known. Do: Upgrade Katello (rubygem-katello) to 4.21.2 or 5.0.1, the releases that fix this issue. Until upgraded, restrict network access to the registry proxy to trusted users and review logs for unexpected registry authorization requests that return differing error responses. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Katello, a content management plugin for Foreman. CVE-2026-56098: Katello: Registry Proxy authorization bypass An authenticated low-privilege user can bypass Registry Proxy authorization checks and enumerate organizations and products through response differences. Affected versions: Katello 4.13.0 through 4.21.1.1, and 5.0.0 CVSS: 4.3 (Moderate) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Fixed...
This source does not provide full text. Read it at seclists.org.