SQL Injection in Red Hat Satellite Katello Registry Proxy

Executive Summary

CVE-2026-56097 is an authenticated SQL injection flaw in Red Hat Satellite Katello Registry Proxy. It exists in the RegistryProxiesController where user-supplied labels from request paths are directly inserted into raw SQL queries without sanitization. The vulnerable methods are check_blob_push_org_label and get_matching_products_from_org.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability in rubygem-katello, inspect the RegistryProxiesController in the Katello application for unsafe SQL interpolation patterns. Look for code using string interpolation like Organization.where("LOWER(label) = '#{org_label}'") or organization.products.where("LOWER(label) = '#{product_label}'"). Check logs for suspicious requests with crafted labels containing SQL fragments such as ' OR '1'='1' or UNION SELECT.

• Review application logs for unusual database query patterns or errors related to SQL syntax.
• Use tools like SQLMap to test for SQL injection by sending crafted payloads to endpoints handling registry proxy requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged users with only create_personal_access_tokens permission to bypass multi-tenancy restrictions. Attackers can exfiltrate global data by dumping the entire PostgreSQL database, including sensitive tables like users and settings. They can also perform vertical privilege escalation by extracting and cracking password hashes for admin accounts.

Useful 0 Not Useful 0

Compliance Impact

This SQL injection vulnerability allows low-privileged users to bypass multi-tenancy restrictions and dump the entire PostgreSQL database, including sensitive tables like users and settings. This could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the rubygem-katello package to the latest patched version that replaces raw SQL interpolation with parameterized queries. Ensure the fix includes changes to use ActiveRecord's safe syntax like Organization.where("LOWER(label) = ?", org_label.downcase).

• Apply the official patch from Red Hat addressing the unsafe SQL interpolation in RegistryProxiesController methods.
• Restrict user permissions to the minimum required, especially for create_personal_access_tokens, and enforce proper RBAC checks for Organizations and Locations.

Useful 0 Not Useful 0