CVE-2026-56097

Executive Summary

CVE-2026-56097 is an SQL injection vulnerability in the Red Hat Satellite Katello Registry Proxy component (rubygem-katello), specifically within the RegistryProxiesController class. The flaw resides in the check_blob_push_org_label and get_matching_products_from_org methods, which fail to sanitize user-supplied labels taken from the request path before interpolating them into raw SQL fragments. An authenticated user with only the create_personal_access_tokens permission—even when restricted with no Organization or Location assigned—can exploit this to read arbitrary data from the underlying database, potentially exposing sensitive configuration, credentials, and inventory data across the Satellite deployment.

Technical Analysis

The vulnerability is a classic SQL injection (CWE-89) arising from improper neutralization of special elements used in SQL commands. In the Red Hat Satellite Katello Registry Proxy, the RegistryProxiesController handles registry-related API requests. Two methods, check_blob_push_org_label and get_matching_products_from_org, accept user-supplied labels directly from the request path. These labels are then concatenated or interpolated into raw SQL query fragments without parameterization or proper escaping.

The attack surface is the registry proxy endpoint exposed by Katello, which is part of the Red Hat Satellite management platform. Because the input is taken from the URL path, an attacker can craft a request containing SQL metacharacters within the label segment. The lack of sanitization allows the attacker to break out of the intended SQL context and inject arbitrary SQL statements. The resulting injection can be used to alter the logic of the query, enabling unauthorized data retrieval.

Notably, the flaw is accessible to a user with only the create_personal_access_tokens permission. This permission is typically granted to even low-privileged accounts, and the vulnerability remains exploitable even when the user has no Organization or Location assigned—meaning that role-based access control (RBAC) restrictions in Katello do not mitigate the issue. This significantly lowers the barrier to exploitation, as an attacker does not need administrative privileges.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that the vulnerability is network-exploitable, requires low attack complexity, requires low privileges (authenticated user), requires no user interaction, and results in a high confidentiality impact while integrity and availability impacts are none. This aligns with an SQL injection that allows data exfiltration but does not directly permit data modification or denial of service.

The exact affected version range of rubygem-katello is not specified in the available intelligence. The NVD description does not list fixed versions, and the patch status is only claimed by a single source (NVD) without independent confirmation. Therefore, defenders should assume that all versions containing the vulnerable methods are at risk until a vendor advisory is released.

Exploitation Scenarios

No public proof-of-concept (PoC) or exploit code is available for CVE-2026-56097. The following attack chain is inferred from the vulnerability class (SQL injection) and the details provided in the NVD description.

1. Reconnaissance and target identification: The attacker identifies a Red Hat Satellite instance with the Katello plugin and registry proxy enabled. This can be done via network scanning or by accessing known registry endpoints. The attacker must possess valid credentials with at least the create_personal_access_tokens permission. Such credentials might be obtained through phishing, credential stuffing, or as a low-privileged insider.

2. Triggering the flaw: The attacker sends a crafted HTTP request to the registry proxy endpoint that invokes either check_blob_push_org_label or get_matching_products_from_org. The request path includes a label parameter that is used directly in an SQL query. By injecting SQL syntax (e.g., single quotes, UNION SELECT, or boolean-based payloads) into the label value, the attacker manipulates the raw SQL fragment.

3. Payload execution: Because the input is interpolated into raw SQL without sanitization, the injected SQL is executed by the database. The attacker can use error-based, union-based, or blind SQL injection techniques to extract data. The specific payload depends on the database backend (likely PostgreSQL, as used by Katello/Foreman). For example, a UNION SELECT could be used to append results from other tables to the legitimate query output.

4. Post-exploitation impact: Successful exploitation allows the attacker to read arbitrary data from the database, including but not limited to: user credentials (hashed passwords, API tokens), system configuration, host inventory, and potentially sensitive content from other organizations or locations that the user is not authorized to access. The vulnerability does not directly allow data modification or remote code execution, but the exfiltrated information could be used to escalate privileges or move laterally within the managed infrastructure.

No public PoC is available; the attack chain is inferred from the vulnerability class and the limited description.

Impact Assessment

The business impact of CVE-2026-56097 is significant due to the high confidentiality impact (CVSS C:H) and the low privileges required (PR:L). Red Hat Satellite is a critical infrastructure management platform used to manage large fleets of Red Hat Enterprise Linux systems, including patching, configuration management, and content distribution. An SQL injection in the registry proxy could expose:

• Authentication secrets (password hashes, session tokens, personal access tokens) for Satellite users, including administrators.
• Detailed inventory of managed hosts, including hostnames, IP addresses, installed packages, and compliance status.
• Configuration data for organizations, locations, and products, which could reveal internal network topology and security policies.

The blast radius is limited to the Satellite server and its database; the vulnerability does not grant direct access to managed hosts. However, the stolen information could enable further attacks, such as credential reuse, lateral movement, or targeted exploitation of managed systems. The CVSS score of 6.5 (Medium) reflects the high confidentiality impact balanced against the requirement for authentication and the lack of integrity/availability impact. The EPSS score is not yet available, and there is no evidence of active exploitation in the wild or inclusion in CISA KEV.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt in Katello Registry Proxy
id: 8f4b2c1e-9d7a-4e3f-8b1c-2a5d6e7f8a9b
status: experimental
description: Detects SQL injection attempts against Red Hat Satellite Katello Registry Proxy methods check_blob_push_org_label and get_matching_products_from_org
author: Threat Intelligence
date: 2026-02-11
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains:
      - '/registry'
      - '/katello'
    cs-uri-query|contains:
      - "'"
      - '"'
      - '--'
      - ';'
      - 'UNION'
      - 'SELECT'
      - 'OR 1=1'
  condition: selection
falsepositives:
  - Legitimate use of quotes in labels (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.56097

YARA Rule

rule CVE_2026_56097_SQLi_Katello_Registry
{
    meta:
        description = "Detects SQL injection strings targeting Katello Registry Proxy methods"
        author = "Threat Intelligence"
        date = "2026-02-11"
        reference = "CVE-2026-56097"
        severity = "high"
    strings:
        $s1 = "check_blob_push_org_label" ascii nocase
        $s2 = "get_matching_products_from_org" ascii nocase
        $sqli1 = "UNION SELECT" ascii nocase
        $sqli2 = "OR 1=1" ascii nocase
        $sqli3 = "'--" ascii nocase
    condition:
        any of ($s*) and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-56097 SQL Injection Attempt in Katello Registry Proxy"; flow:to_server,established; http.uri; content:"/registry"; nocase; http.uri; content:"'"; http.uri; content:"UNION"; nocase; distance:0; within:20; classtype:web-application-attack; sid:10000001; rev:1; reference:cve,2026-56097;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "GET" and
   http.request.uri : ("*check_blob_push_org_label*" or "*get_matching_products_from_org*") and
   http.request.uri : ("*'*" or "*UNION*" or "*--*")]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| where match(uri, "(?i)(check_blob_push_org_label|get_matching_products_from_org)")
| where match(uri, "('|--|UNION|SELECT|OR 1=1)")
| stats count by src_ip, uri, status
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,sql_injection,">
  <rule id="100100" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>check_blob_push_org_label|get_matching_products_from_org</url>
    <regex>('|--|UNION|SELECT|OR 1=1)</regex>
    <description>CVE-2026-56097: SQL injection attempt in Katello Registry Proxy</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,cve_2026_56097,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations:

   • Restrict network access to the Katello registry proxy endpoints to trusted networks or IP ranges only.
   • Audit user accounts with the create_personal_access_tokens permission and remove it from users who do not explicitly require it.
   • Monitor web server logs for anomalous requests containing SQL metacharacters in registry-related paths.
   • If possible, temporarily disable the registry proxy feature until a patch can be applied, though this may impact container image workflows.

2. Patch/upgrade steps:

   • A patch is claimed by a single source (NVD) but no specific version or advisory is available. Monitor the Red Hat Security Advisory (RHSA) page and the Katello project repository for official fixes.
   • Once a fixed version is released, upgrade rubygem-katello and the underlying Red Hat Satellite platform to the latest patched version. Follow Red Hat's standard upgrade procedures.

3. Long-term hardening:

   • Implement parameterized queries or prepared statements for all database interactions in custom application code to prevent SQL injection.
   • Enforce strict input validation and sanitization on all user-supplied data, especially labels and identifiers used in SQL queries.
   • Apply the principle of least privilege to service accounts and application users.
   • Conduct regular security code reviews and static application security testing (SAST) for Ruby on Rails applications.
   • Deploy a web application firewall (WAF) with virtual patching for SQL injection patterns as a defense-in-depth measure.

References

• NVD – CVE-2026-56097: https://nvd.nist.gov/vuln/detail/CVE-2026-56097
• Red Hat Security Advisories: https://access.redhat.com/security/security-updates/
• Katello Project: https://katello.org/
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE at the time of writing.