CVE-2026-4324

Rubygem-katello: katello: denial of service and potential information disclosure via sql injection

5.4 MediumFix available

A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: Low

Exploit likelihood

0.28%Up 0.2 points since Mar 18, 2026

What each source reports

CVE List Score used 5.4

Rubygem-katello: katello: denial of service and potential information disclosure via sql injection

Record: CVE-2026-4324
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-89
Updated: 2026-11-03

EUVDEUVD-2026-12572 5.4

Record: EUVD-2026-12572
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fwj4-6wgp-mpxm 5.4

Katello: Denial of Service and potential information disclosure via SQL injection

Record: GHSA-fwj4-6wgp-mpxm
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-89
Updated: 2026-11-02

NVD 5.4

Record: CVE-2026-4324
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-89
Updated: 2026-11-02

OSVGHSA-fwj4-6wgp-mpxm 5.4

Katello: Denial of Service and potential information disclosure via SQL injection

Record: GHSA-fwj4-6wgp-mpxm
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-89
Updated: 2026-11-02

OSVRHSA-2026:22326 7.8

Red Hat Security Advisory: Satellite 6.19.1 Async Update

Record: RHSA-2026:22326
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:5968 8.3

Red Hat Security Advisory: Satellite 6.18.4 Async Update

Record: RHSA-2026:5968
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

OSVRHSA-2026:5970 8.5

Red Hat Security Advisory: Satellite 6.17.7 Async Update

Record: RHSA-2026:5970
CVSS 3.1: 8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`katello` RubyGems	before 4.19.1	4.19.1
`katello` RubyGems	before 4.19.1, plus listed versions 1.5.02.2.22.4.02.4.0.rc12.4.0.rc2 Show 45 moreShow less 2.4.0.rc32.4.12.4.22.4.32.4.42.4.53.0.03.0.0.rc13.0.0.rc23.0.0.rc33.0.0.rc43.0.0.rc53.0.0.rc73.0.13.0.23.1.03.1.0.13.1.0.rc13.1.0.rc2.13.10.03.10.0.rc13.10.0.rc1.13.10.13.10.1.13.10.23.11.03.11.0.rc13.11.0.rc23.11.13.11.23.12.03.12.0.rc13.12.0.rc23.12.13.12.23.12.33.13.03.13.0.rc13.13.0.rc23.13.0.rc2.13.13.13.13.23.13.33.13.43.14.0	4.19.1
`rubygem-katello` Red Hat:satellite:6.19::el9 From an advisory covering 2 CVEs	before 0:4.20.0.4-1.el9sat	0:4.20.0.4-1.el9sat
`dynflow-utils` Red Hat:satellite_capsule:6.19::el9 From an advisory covering 2 CVEs	before 0:2.0.1-1.el9sat	0:2.0.1-1.el9sat
`dynflow-utils` Red Hat:satellite:6.19::el9 From an advisory covering 2 CVEs	before 0:2.0.1-1.el9sat	0:2.0.1-1.el9sat
`yggdrasil-worker-forwarder` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:0.0.3-4.el9sat	0:0.0.3-4.el9sat
`rubygem-rubyipmi` Red Hat:satellite_capsule:6.18::el9 From an advisory covering 7 CVEs	before 0:0.13.0-1.el9sat	0:0.13.0-1.el9sat
`rubygem-rubyipmi` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:0.13.0-1.el9sat	0:0.13.0-1.el9sat
`rubygem-foreman_kubevirt` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:0.4.3-1.el9sat	0:0.4.3-1.el9sat
`foreman` Red Hat:satellite_capsule:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat

Show 95 moreShow less

Affected packages
Package	Affected	Fixed
`foreman-debug` Red Hat:satellite_capsule:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-pcp` Red Hat:satellite_capsule:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman` Red Hat:satellite_utils:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-cli` Red Hat:satellite_utils:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-cli` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-debug` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-dynflow-sidekiq` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-ec2` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-journald` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-libvirt` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-openstack` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-pcp` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-postgresql` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-redis` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-service` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-telemetry` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`foreman-vmware` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:3.16.0.12-1.el9sat	0:3.16.0.12-1.el9sat
`rubygem-katello` Red Hat:satellite:6.18::el9 From an advisory covering 7 CVEs	before 0:4.18.0.9-1.el9sat	0:4.18.0.9-1.el9sat
`foreman` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-debug` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-pcp` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`libcomps` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`libcomps-debuginfo` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`libcomps-debugsource` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python-brotli` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python-brotli-debugsource` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python-django` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:4.2.28-0.1.el9pc	0:4.2.28-0.1.el9pc
`python-pulp-container` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:2.22.3-1.el9pc	0:2.22.3-1.el9pc
`python-pulp-rpm` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:3.27.10-2.el9pc	0:3.27.10-2.el9pc
`python3-libcomps` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3-libcomps-debuginfo` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-brotli` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python3.11-brotli-debuginfo` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python3.11-django` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:4.2.28-0.1.el9pc	0:4.2.28-0.1.el9pc
`python3.11-libcomps` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-libcomps-debuginfo` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-pulp-container` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:2.22.3-1.el9pc	0:2.22.3-1.el9pc
`python3.11-pulp-rpm` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:3.27.10-2.el9pc	0:3.27.10-2.el9pc
`rubygem-rubyipmi` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:0.13.0-1.el9sat	0:0.13.0-1.el9sat
`satellite` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-capsule` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-common` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-obsolete-packages` Red Hat:satellite_capsule:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`libcomps` Red Hat:satellite_maintenance:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`libcomps-debuginfo` Red Hat:satellite_maintenance:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`libcomps-debugsource` Red Hat:satellite_maintenance:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3-libcomps` Red Hat:satellite_maintenance:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3-libcomps-debuginfo` Red Hat:satellite_maintenance:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-libcomps-debuginfo` Red Hat:satellite_maintenance:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`foreman` Red Hat:satellite_utils:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-cli` Red Hat:satellite_utils:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`satellite` Red Hat:satellite_utils:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-cli` Red Hat:satellite_utils:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`foreman` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-cli` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-debug` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-dynflow-sidekiq` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-ec2` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-journald` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-libvirt` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-openstack` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-ovirt` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-pcp` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-postgresql` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-redis` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-service` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-telemetry` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`foreman-vmware` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.14.0.14-1.el9sat	0:3.14.0.14-1.el9sat
`libcomps` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`libcomps-debuginfo` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`libcomps-debugsource` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python-brotli` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python-brotli-debugsource` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python-django` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:4.2.28-0.1.el9pc	0:4.2.28-0.1.el9pc
`python-pulp-container` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:2.22.3-1.el9pc	0:2.22.3-1.el9pc
`python-pulp-rpm` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.27.10-2.el9pc	0:3.27.10-2.el9pc
`python3-libcomps` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3-libcomps-debuginfo` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-brotli` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python3.11-brotli-debuginfo` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:1.2.0-0.1.el9pc	0:1.2.0-0.1.el9pc
`python3.11-django` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:4.2.28-0.1.el9pc	0:4.2.28-0.1.el9pc
`python3.11-libcomps` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-libcomps-debuginfo` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.1.23-0.3.el9pc	0:0.1.23-0.3.el9pc
`python3.11-pulp-container` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:2.22.3-1.el9pc	0:2.22.3-1.el9pc
`python3.11-pulp-rpm` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:3.27.10-2.el9pc	0:3.27.10-2.el9pc
`rubygem-fog-kubevirt` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:1.5.1-1.el9sat	0:1.5.1-1.el9sat
`rubygem-foreman_kubevirt` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.4.3-1.el9sat	0:0.4.3-1.el9sat
`rubygem-katello` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:4.16.0.14-1.el9sat	0:4.16.0.14-1.el9sat
`rubygem-rubyipmi` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.13.0-1.el9sat	0:0.13.0-1.el9sat
`satellite` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-cli` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-common` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`satellite-obsolete-packages` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:6.17.7-1.el9sat	0:6.17.7-1.el9sat
`yggdrasil-worker-forwarder` Red Hat:satellite:6.17::el9 From an advisory covering 12 CVEs	before 0:0.0.3-4.el9sat	0:0.0.3-4.el9sat

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	CVE List
Nov 3, 2026	facts	EUVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-4324 is a medium vulnerability (CVSS 5.4) in Red Hat Satellite 6, published March 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in katello 4.19.1.

References

Show 112 moreShow less

This page doesn't list everything

Left out here: 220 versions. The JSON record has them.