Katello patches two Registry Proxy flaws in 4.21.2 and 5.0.1

Katello fixed CVE-2026-56098 and CVE-2026-56097 in Registry Proxy; no in-the-wild exploitation is reported.

Katello, the content-management plugin for Foreman, patched two Registry Proxy issues disclosed on 7 October 2026. CVE-2026-56098 is an authorization bypass that lets an authenticated low-privilege user skip checks and enumerate organizations and products by observing response differences; it is scored CVSS 3.1 4.3 (Moderate), with network access, low privileges, and low confidentiality impact, and affects Katello 4.13.0 through 4.21.1.1 and 5.0.0. CVE-2026-56097 is SQL injection in Registry Proxy label handling, where unsanitized label parameters from an authenticated low-privilege user are interpolated into database queries and can expose data across authorization boundaries. That report lists affected releases as 4.13.0 through 4.21.1.1 and does not explicitly name 5.0.0, while both advisories say the fixes are in 4.21.2 and 5.0.1. Neither disclosure reports exploitation in the wild.

• CVE-2026-56098 is a Katello Registry Proxy authorization bypass: an authenticated low-privilege user can skip checks and enumerate organizations and products by observing response differences.
• CVE-2026-56098 has CVSS 3.1 4.3 (Moderate): network, low privileges, confidentiality low; it affects Katello 4.13.0 through 4.21.1.1 and 5.0.0, fixed in 4.21.2 and 5.0.1.
• CVE-2026-56097 is SQL injection in Registry Proxy label handling: unsanitized label parameters from an authenticated low-privilege user are interpolated into database queries and can expose data across authorization boundaries.
• The SQL-injection report lists affected releases as Katello 4.13.0 through 4.21.1.1 and does not name 5.0.0; both issues are fixed in 4.21.2 and 5.0.1.
• Katello is the content-management plugin for Foreman; both oss-security reports are dated 2026-10-07 and neither reports exploitation in the wild.