# CVE-2026-4324: Red Hat Satellite Katello SQL injection in bootc_images API

Source: https://junglewise.ai/threats/cve-2026-4324-red-hat-satellite-katello-sql-injection-in-bootc-images-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-17. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-4324 · Severity: medium · CVSS 5.4 · Published 2026-03-17

A security vulnerability exists in Katello, a management plugin used by Red Hat Satellite to handle software subscriptions and repository content. An attacker with low-level access can send specially crafted requests to the system's API to disrupt operations or potentially view sensitive database information. This could lead to a service outage or the unauthorized exposure of internal system data.

Technologies: [Red Hat Katello](https://junglewise.ai/threats/technologies/katello), [katello (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-katello). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-4324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4324 being exploited in the wild.

**How severe is CVE-2026-4324?** Medium severity, with a CVSS score of 5.4, published 17 March 2026.

**Which products and versions are affected?** Red Hat Katello < 4.19.1, 4.18, 4.20; katello (RubyGems) ECOSYSTEM:introduced=0,fixed=4.19.1.

**Is there a fix for CVE-2026-4324?** Yes. katello (RubyGems): upgrade to 4.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4324 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4324?** Check whether you run Red Hat Katello or katello (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- katello (RubyGems): upgrade to 4.19.1 or later

  ```sh
  bundle update katello
  ```


## Technical details

A SQL injection vulnerability exists in the Katello plugin for Red Hat Satellite due to improper sanitization of the 'sort_by' parameter in the '/api/hosts/bootc_images' API endpoint. An authenticated remote attacker with low privileges can inject arbitrary SQL commands into the 'ORDER BY' clause of database queries. While underlying framework protections may block some complex queries, an attacker can still trigger database errors to cause a Denial of Service (DoS) or perform Boolean-based Blind SQL injection to extract sensitive data. The issue is fixed in Katello version 4.19.1 and addressed in Red Hat Satellite via RHSA-2026:5970 and RHSA-2026:5968.

## Affected products

- Red Hat katello < 4.19.1
- Red Hat Satellite 6.17, 6.18

## Identifiers

- CVE-2026-4324
- GHSA-fwj4-6wgp-mpxm

## Timeline

- 2026-03-17: disclosed
- 2026-03-17: advisory
- 2026-03-18: other: GitHub advisory reviewed
- 2026-03-26: patched: Red Hat security advisories issued

## References

- [https://access.redhat.com/security/cve/CVE-2026-4324](https://access.redhat.com/security/cve/CVE-2026-4324)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2448349](https://bugzilla.redhat.com/show_bug.cgi?id=2448349)
- [https://github.com/Katello/katello/commit/a0a793b08d4f0a897ee985d79a687ad043f99e57](https://github.com/Katello/katello/commit/a0a793b08d4f0a897ee985d79a687ad043f99e57)
- [https://access.redhat.com/errata/RHSA-2026:5968](https://access.redhat.com/errata/RHSA-2026:5968)
- [https://access.redhat.com/errata/RHSA-2026:5970](https://access.redhat.com/errata/RHSA-2026:5970)

## Related threats

- [Katello authorization bypass in RegistryProxiesController](https://junglewise.ai/threats/cve-2026-56098-a-flaw-was-found-in-rubygem-katello-the-registryproxiescontroller)
- [Red Hat Katello Content View Filter Rules API authorization bypass](https://junglewise.ai/threats/cve-2026-81668-red-hat-katello-content-view-filter-rules-api-authorization)
- [Red Hat Katello Content View History API authorization bypass](https://junglewise.ai/threats/cve-2026-79654-red-hat-katello-content-view-history-api-authorization-bypass)
- [Red Hat Satellite Katello missing authorization in ContentUploadsController](https://junglewise.ai/threats/cve-2026-12515-red-hat-satellite-katello-missing-authorization-in)
- [Katello cleartext password storage issue](https://junglewise.ai/threats/cve-2019-14825-katello-cleartext-password-storage-issue)