CVE-2026-56097

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.

• CWE-89

• https://access.redhat.com/errata/RHSA-2026:74503
• https://access.redhat.com/errata/RHSA-2026:74504
• https://access.redhat.com/errata/RHSA-2026:74505
• https://access.redhat.com/errata/RHSA-2026:74506
• https://access.redhat.com/security/cve/CVE-2026-56097
• https://bugzilla.redhat.com/show_bug.cgi?id=2490543
• https://www.openwall.com/lists/oss-security/2026/10/07/4

Published

Oct 1, 2026

Last Modified

Nov 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56091When using Apache Shiro with the shiro-guice module in a web…8.2
• CVE-2026-56092The extension forces empty frontend-group and subpage-inheri…7.6
• CVE-2026-56093The extension's frontend detail-view document lookup does no…6.3
• CVE-2026-56094The extension allows a request-provided additionalFilters pa…6.3
• CVE-2026-56095The extension's indexer passed every field value returned by…7.7
• CVE-2026-56096The extension passes the user-supplied search query paramete…6.3
• CVE-2026-56098A flaw was found in rubygem-katello. The RegistryProxiesCont…4.3
• CVE-2026-56099OpenBSD before commit 6a23123 (2026-06-18) contains an out-o…5.3
• CVE-2026-5610A vulnerability has been found in Belkin F9K1015 1.00.10. Af…8.8
• CVE-2026-56100SpringBlade versions from 2.7.3 up to but not including 5.0.…8.1
• CVE-2026-56101OpenBSD before commit 1ee99df contains an inverted compariso…5.3
• CVE-2026-56104Chainlit before 2.10.1 contains a session hijacking vulnerab…8.2