CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1)
Katello Registry Proxy label parameters allow authenticated SQL injection that can cross authorization boundaries.
Katello, the content-management plugin for Foreman, patched CVE-2026-56097, a SQL injection in Registry Proxy label handling. An authenticated low-privilege user can pass unsanitized label parameters that are interpolated into database queries and expose data across authorization boundaries. Affected releases are Katello 4.13.0 through 4.21.1.1; the fix is in 4.21.2 and 5.0.1. The disclosure does not report active exploitation.
- Authenticated low-privilege users can inject SQL via Registry Proxy label parameters.
- Unsanitized input is interpolated into database queries.
- Injection can expose data across authorization boundaries.
- Katello 4.13.0 through 4.21.1.1 are affected; fixed in 4.21.2 and 5.0.1.
Vulnerabilities mentionedAll →
- CVE-2026-560976.5—SQL injection in Katello Registry Proxy (Red Hat Satellite)published · Red Hat rubygem-katello (Katello Registry Proxy, used by Red Hat Satellite)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-56097 | SQL injection in Katello Registry Proxy (Red Hat Satellite) An SQL injection flaw in rubygem-katello allows a low-privileged user to read data through the Red Hat Satellite Katello Registry Proxy. In RegistryProxiesController, check_blob_push_org_label and get_matching_products_from_org take organization labels from the request path and insert them into raw SQL without sanitization. A user who has only the create_personal_access_tokens permission can trigger this over the network even with no Organization or Location assigned, with high impact to confidentiality and no direct integrity or availability impact (CVSS 3.1 6.5). Katello installs that are not yet on the fixed releases are affected. No public proof of concept is known and the issue is not in the CISA KEV catalog. |
Posted by Ondrej Gajdusek on Oct 06 Hi, A security fix has been released in Katello, a content management plugin for Foreman. CVE-2026-56097: Katello: SQL injection in Registry Proxy labels An authenticated low-privilege user can inject SQL through Katello Registry Proxy label parameters because input is interpolated into database queries without sufficient sanitization. This can expose data across authorization boundaries. Affected versions: Katello 4.13.0 through 4.21.1.1,...
This source does not provide full text. Read it at seclists.org.