Skip to content
fr Sign in
5.4 Medium

CVE-2026-4324 A flaw was found in the Katello plugin for Red Hat Satellite

Description

A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.

Affected products and versions

Product Affected versions Fixed in
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published
Red Hat Satellite 6.19 for RHEL 9 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Satellite 6.17 for RHEL 9

The 46 CVEs of Red Hat Satellite 6.17 for RHEL 9 →
CVE-2026-56098 A flaw was found in rubygem-katello 4.3 Medium CVE-2026-56097 A flaw was found in rubygem-katello 6.5 Medium CVE-2026-12545 A flaw was found in rubygem-hammer_cli 6.7 Medium CVE-2026-12542 A flaw was found in Foreman 5.3 Medium
Track this CVE