Is CVE-2026-4324 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4324 being exploited in the wild.

How severe is CVE-2026-4324?

Medium severity, with a CVSS score of 5.4, published 17 March 2026.

Which products and versions are affected?

Red Hat Katello < 4.19.1, 4.18, 4.20; katello (RubyGems) ECOSYSTEM:introduced=0,fixed=4.19.1.

Is there a fix for CVE-2026-4324?

Yes. katello (RubyGems): upgrade to 4.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4324 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4324?

Check whether you run Red Hat Katello or katello (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4324: Red Hat Satellite Katello SQL injection in bootc_images API

Q: Which products and versions are affected?

Red Hat Katello < 4.19.1, 4.18, 4.20; katello (RubyGems) ECOSYSTEM:introduced=0,fixed=4.19.1.

Q: Is there a fix for CVE-2026-4324?

Yes. katello (RubyGems): upgrade to 4.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-4324 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-4324?

Check whether you run Red Hat Katello or katello (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4324 · Severity: medium · CVSS 5.4 · Published 2026-03-17

A security vulnerability exists in Katello, a management plugin used by Red Hat Satellite to handle software subscriptions and repository content. An attacker with low-level access can send specially crafted requests to the system's API to disrupt operations or potentially view sensitive database information. This could lead to a service outage or the unauthorized exposure of internal system data.

Technologies: Red Hat Katello, katello (RubyGems). Vendors: Red Hat, RubyGems.

Quick answers

Is CVE-2026-4324 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4324 being exploited in the wild.
How severe is CVE-2026-4324?: Medium severity, with a CVSS score of 5.4, published 17 March 2026.
Which products and versions are affected?: Red Hat Katello < 4.19.1, 4.18, 4.20; katello (RubyGems) ECOSYSTEM:introduced=0,fixed=4.19.1.
Is there a fix for CVE-2026-4324?: Yes. katello (RubyGems): upgrade to 4.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4324 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4324?: Check whether you run Red Hat Katello or katello (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

katello (RubyGems): upgrade to 4.19.1 or later
```
bundle update katello
```

Technical details

A SQL injection vulnerability exists in the Katello plugin for Red Hat Satellite due to improper sanitization of the 'sort_by' parameter in the '/api/hosts/bootc_images' API endpoint. An authenticated remote attacker with low privileges can inject arbitrary SQL commands into the 'ORDER BY' clause of database queries. While underlying framework protections may block some complex queries, an attacker can still trigger database errors to cause a Denial of Service (DoS) or perform Boolean-based Blind SQL injection to extract sensitive data. The issue is fixed in Katello version 4.19.1 and addressed in Red Hat Satellite via RHSA-2026:5970 and RHSA-2026:5968.

Affected products

Red Hat katello < 4.19.1
Red Hat Satellite 6.17, 6.18

Identifiers

CVE-2026-4324
GHSA-fwj4-6wgp-mpxm

Timeline

2026-03-17: disclosed
2026-03-17: advisory
2026-03-18: other: GitHub advisory reviewed
2026-03-26: patched: Red Hat security advisories issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.