CVE-2026-56097: SQL Injection

Vulnerability summary

CVE-2026-56097 is a medium (CVSS 6.5) SQL Injection vulnerability. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.6% of scored vulnerabilities.

Timeline

1. 01-10-2026
   PublishedVulnerability first disclosed.
2. 07-10-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.