CVE-2026-56097
Rubygem-katello: sql injection in registry proxy via labels
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.
| CWE | CWE-89 |
| Vendor | red hat |
| Product | red hat satellite 6.19 for rhel 9 |
| Published | Oct 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat satellite 6.19 for rhel 9
Be the first to know when new medium vulnerabilities affecting red hat red hat satellite 6.19 for rhel 9 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Red Hat / Red Hat Satellite 6.19 for RHEL 9
All versions affected Red Hat / Red Hat Satellite 6
All versions affected Red Hat / Red Hat Satellite 6
All versions affected References
Credits
This issue was discovered by Laura Pardo (Red Hat) and Toni Gornals (Red Hat).