EUVD-2026-90970
GHSA-mmq3-mv36-wfm7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable SQLi with low complexity; PR:L because a trivially-granted create_personal_access_tokens permission is required; confidentiality-only DB read impact per vendor scoping.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.
AnalysisAI
An authenticated low-privileged user can inject SQL through the Katello Registry Proxy in Red Hat Satellite 6 by placing a crafted label in the request path, allowing them to read arbitrary data from the Satellite database. The vulnerable code paths (check_blob_push_org_label and get_matching_products_from_org) interpolate request-supplied labels straight into raw SQL, and the only prerequisite is an account holding the create_personal_access_tokens permission - even a heavily restricted account with no Organization or Location assigned, which makes the effective privilege bar unusually low. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account possessing the create_personal_access_tokens permission on Red Hat Satellite; notably this works even for heavily restricted users with NO Organization or Location assigned, so the effective privilege bar is very low. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority vulnerability, not a critical drop-everything issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Red Hat has released erratum RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503), so patch availability is confirmed per the vendor advisory - apply the updated rubygem-katello and related Satellite component packages via the standard Satellite maintenance/errata process and consult the advisory for the exact fixed build identifiers, since a discrete fix version string is not published in the CVE data itself. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permi
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repositor
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logi
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today