Katello CVE-2026-107444

Exploitation requires an authenticated account (PR:L) that has permission to view products in at least one organization on a multi-organization Satellite/Katello deployment, plus network access to the Docker Tags repositories API. The specific trigger is supplying a Docker meta tag identifier that belongs to a different organization; the API lists its repositories without enforcing organization scoping. Limiting factors: the attacker must already have valid credentials and product-view rights, the instance must host more than one organization for cross-boundary disclosure to have meaning, and the attacker needs to know or enumerate valid foreign tag identifiers. Impact is confined to disclosure of repository configuration metadata - no modification (I:N) or service disruption (A:N).

This is a genuine but low-severity information-disclosure issue, correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The signals are internally consistent and point to a bounded, not an urgent, risk: the vector is network-reachable with low complexity, but exploitation requires an already-authenticated user holding legitimate permission to view products in at least one organization (PR:L), and impact is limited to low confidentiality with no integrity or availability effect (C:L/I:N/A:N). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not a drop-everything priority. The core risk is a multi-tenancy/org-boundary weakness (CWE-639, IDOR-style authorization bypass), which matters disproportionately for service providers or large enterprises running multiple organizations in one Satellite/Katello instance, where cross-tenant metadata leakage breaks an expected trust boundary. One data note: the input Tag labels this 'Authentication Bypass,' but the description and CWE-639 make clear it is an authorization (org-scoping) failure by an authenticated user, not an authentication bypass - treat the tag as imprecise.

An authenticated Satellite/Katello user who legitimately administers products in Organization A supplies a Docker meta tag identifier belonging to Organization B to the Docker Tags repositories API. Because the API fails to enforce organization scoping, it returns repository metadata for the other organization, disclosing repository configuration the user should not see. No public exploit code was identified in the input, and exploitation requires only a valid low-privilege account plus a reachable network path to the API.