CVE-2026-56098
Last modified
CVE-2026-56098 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | All versions |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | All versions |
| Red Hat | Red Hat Satellite 6 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-56098?
How severe is CVE-2026-56098?
How do I fix CVE-2026-56098?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56092The extension forces empty frontend-group and subpage-inheri…7.6
- CVE-2026-56093The extension's frontend detail-view document lookup does no…6.3
- CVE-2026-56094The extension allows a request-provided additionalFilters pa…6.3
- CVE-2026-56095The extension's indexer passed every field value returned by…7.7
- CVE-2026-56096The extension passes the user-supplied search query paramete…6.3
- CVE-2026-56097A flaw was found in rubygem-katello. An SQL injection vulner…6.5
- CVE-2026-56099OpenBSD before commit 6a23123 (2026-06-18) contains an out-o…5.3
- CVE-2026-5610A vulnerability has been found in Belkin F9K1015 1.00.10. Af…8.8
- CVE-2026-56100SpringBlade versions from 2.7.3 up to but not including 5.0.…8.1
- CVE-2026-56101OpenBSD before commit 1ee99df contains an inverted compariso…5.3
- CVE-2026-56104Chainlit before 2.10.1 contains a session hijacking vulnerab…8.2
- CVE-2026-56109The Advanced Linux Sound Architecture (ALSA) library before …6.8
Are you affected by CVE-2026-56098?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST