What’s Vulnerable › Vulnerabilities

CVE-2026-107444: Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-29
• Weakness: CWE-639

Description

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with Docker tags belonging to another organization by supplying the tag identifier. This can result in unauthorized disclosure of repository configuration information across organization boundaries.

Affected products

• Red Hat Satellite 6: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-107444
• https://bugzilla.redhat.com/show_bug.cgi?id=2547765

Get alerted when CVE-2026-107444 or the next vulnerability affects your stack