Read the docs
TI-2026-40487 Aliases CVE-2026-56097GHSA-mmq3-mv36-wfm7

Rubygem-katello: sql injection in registry proxy via labels

Priority LOW 29CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-89.

Summary

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Satellite 6.16 for RHEL 8—4.14.0.23-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—4.14.0.23-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6.17 for RHEL 9—4.16.0.20-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6.18 for RHEL 9—4.18.0.24-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6.19 for RHEL 9—4.20.0.11-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6——No fix listedCNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 4.14.0.23-1.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 4.14.0.23-1.el9sat Patch available CNA
  • Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 4.16.0.20-1.el9sat Patch available CNA
  • Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 4.18.0.24-1.el9sat Patch available CNA
  • Red Hat Satellite 6.19 for RHEL 9 VendorRed Hat Affected — Fixed in 4.20.0.11-1.el9sat Patch available CNA
  • Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 16

CPEVersionsRoleVendor
cpe:/a:redhat:satellite:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_capsule:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_utils:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite:6.18::el96.18—Red Hat
  • cpe:/a:redhat:satellite:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite:6.18::el9 Versions 6.18 — ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:satellite_capsule:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite_utils:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite_capsule:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite_utils:6.19::el96.19—Red Hat
cpe:/a:redhat:satellite:66—Red Hat
  • cpe:/a:redhat:satellite_capsule:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.19::el9 Versions 6.19 — ·Red Hat
  • cpe:/a:redhat:satellite:6 Versions 6 — ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2026:74506 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.16.14 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.23-1.el8sat, foreman-cli-3.12.0.23-1.el8sat, foreman-debug-3.12.0.23-1.el8sat +32
    • Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.23-1.el9sat, foreman-cli-3.12.0.23-1.el9sat, foreman-debug-3.12.0.23-1.el9sat +32
  • RHSA-2026:74505 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.17.12 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.22-1.el9sat, foreman-cli-3.14.0.22-1.el9sat, foreman-debug-3.14.0.22-1.el9sat +31
  • RHSA-2026:74504 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.18.10 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.25-1.el9sat, foreman-cli-3.16.0.25-1.el9sat, foreman-debug-3.16.0.25-1.el9sat +26
Show 1 more Red Hat advisories
  • RHSA-2026:74503 Released 2026-10-01 · Red Hat rating Critical
    Satellite 6.19.5 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 foreman-3.18.0.14-1.el9sat, foreman-cli-3.18.0.14-1.el9sat, foreman-debug-3.18.0.14-1.el9sat +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:74506
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:74506
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:74505
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:74504
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:74503
Not affected: 5 products
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56097
  2. 2026-10-03 Alias added: GHSA-mmq3-mv36-wfm7
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-11-03 Affected versions changed · CNA

References

Advisory 4

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences