CVE-2026-56097

Name of the Vulnerable Software and Affected Versions rubygem-katello (affected versions not specified)

Description An SQL injection issue exists in the Red Hat Satellite Katello Registry Proxy due to improper sanitization of input parameters used in database queries within the RegistryProxiesController. Specifically, the functions check blob push org label() and get matching products from org() take user-supplied labels from the request path and interpolate them into raw SQL fragments. This allows a user with only the create personal access tokens permission to exploit the flaw, regardless of whether they have an assigned Organization or Location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.