EUVD-2026-90971
GHSA-f6cg-x72x-c392
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Remote low-privilege authenticated user (AV:N/AC:L/PR:L) exploits a control-flow fall-through to enumerate entities; only limited confidentiality impact (C:L) with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.
AnalysisAI
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privilege account able to reach the Katello/Red Hat Satellite RegistryProxiesController (container registry proxy endpoints), consistent with PR:L - the registry_authorize filter correctly flags the request as unauthorized but fails to halt execution (missing return), so no special or non-default configuration is needed beyond the standard registry proxy being in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent and point to a genuine-but-modest-severity issue rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch as described in Red Hat errata RHSA-2026:74503 (https://access.redhat.com/errata/RHSA-2026:74503). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Satellite 6
View allArbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Command injection in the Red Hat Satellite job invocation API (/api/v2/job_invocations), shipped via the rubygem-foreman
Privilege escalation in Foreman (the engine behind Red Hat Satellite 6) lets an authenticated user holding usergroup-man
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
OS command injection in Foreman's foreman-rake db:dump and db:import_dump tasks lets an attacker who already holds permi
Command injection in the Foreman foreman-rake errors:fetch_log task shipped with Red Hat Satellite 6 allows a local user
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repositor
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logi
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution is achievable in Red Hat Foreman and Satellite 6 via command injection in the WebSocket proxy impl
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Session hijacking in the foreman-mcp-server component (shipped with Red Hat Satellite 6) allows local attackers to take
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today