CVE-2026-56097: Rubygem-katello: sql injection in registry proxy via labels

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-07
Weakness: CWE-89

Description

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.

Affected products

Red Hat Satellite 6.16 for RHEL 8: all versions — fixed in 0:4.14.0.23-1.el8sat
Red Hat Satellite 6.16 for RHEL 9: all versions — fixed in 0:4.14.0.23-1.el9sat
Red Hat Satellite 6.17 for RHEL 9: all versions — fixed in 0:4.16.0.20-1.el9sat
Red Hat Satellite 6.18 for RHEL 9: all versions — fixed in 0:4.18.0.24-1.el9sat
Red Hat Satellite 6.19 for RHEL 9: all versions — fixed in 0:4.20.0.11-1.el9sat
Red Hat Satellite 6: all versions

How to fix

Upgrade to a fixed version: Red Hat Satellite 6.16 for RHEL 8 0:4.14.0.23-1.el8sat; Red Hat Satellite 6.16 for RHEL 9 0:4.14.0.23-1.el9sat; Red Hat Satellite 6.17 for RHEL 9 0:4.16.0.20-1.el9sat; Red Hat Satellite 6.18 for RHEL 9 0:4.18.0.24-1.el9sat; Red Hat Satellite 6.19 for RHEL 9 0:4.20.0.11-1.el9sat. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56097 or the next vulnerability affects your stack