https://seclists.org/oss-sec/2026/q4/63: CVE-2026-56097: Katello: SQL injection in gistry Proxy labels (fixed in 4.21.2, 5.0.1)

Q: Who can exploit this issue?

An authenticated low-privilege user can exploit it. The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required.

Q: Which deployments are affected?

Katello versions 4.13.0 through 4.21.1.1, and version 5.0.0, are affected. The issue is fixed in Katello 4.21.2 and 5.0.1.

Q: What is the likely impact of successful exploitation?

SQL injection through Registry Proxy label parameters can expose data across authorization boundaries. The reported impact is high confidentiality impact, with no reported integrity or availability impact.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Katello Katello>=4.13.0<=4.21.1.1, =5.0.0

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privilege user can exploit it. The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required.

Which deployments are affected?

Katello versions 4.13.0 through 4.21.1.1, and version 5.0.0, are affected. The issue is fixed in Katello 4.21.2 and 5.0.1.

What is the likely impact of successful exploitation?

SQL injection through Registry Proxy label parameters can expose data across authorization boundaries. The reported impact is high confidentiality impact, with no reported integrity or availability impact.