https://seclists.org/oss-sec/2026/q4/62: CVE-2026-56098: Katello: gistry Proxy authorization bypass (fixed in 4.21.2, 5.0.1)

Q: Which deployments are affected?

Katello versions 4.13.0 through 4.21.1.1 and version 5.0.0 are affected. The issue is fixed in Katello 4.21.2 and 5.0.1.

Q: What access does an attacker need?

An attacker needs an authenticated low-privilege user account. No user interaction is required, and the issue is reachable over the network.

Q: What could an attacker learn through this issue?

The authorization bypass allows enumeration of organizations and products through differences in Registry Proxy responses. The reported impact is limited to confidentiality; no integrity or availability impact is stated.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Foreman Katello>=4.13.0<=4.21.1.1, =5.0.0

Frequently Asked Questions

Which deployments are affected?

Katello versions 4.13.0 through 4.21.1.1 and version 5.0.0 are affected. The issue is fixed in Katello 4.21.2 and 5.0.1.

What access does an attacker need?

An attacker needs an authenticated low-privilege user account. No user interaction is required, and the issue is reachable over the network.

What could an attacker learn through this issue?

The authorization bypass allows enumeration of organizations and products through differences in Registry Proxy responses. The reported impact is limited to confidentiality; no integrity or availability impact is stated.