Is CVE-2026-56097 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56097 being exploited in the wild.

How severe is CVE-2026-56097?

Medium severity, with a CVSS score of 6.5, published 1 October 2026.

Which products and versions are affected?

Red Hat Satellite 6.19.5 and earlier.

Is there a fix for CVE-2026-56097?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56097 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56097?

Check whether you run Red Hat Satellite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56097: Red Hat Satellite Katello SQL injection in Registry Proxy

CVE-2026-56097 · Severity: medium · CVSS 6.5 · Published 2026-10-01

Red Hat Satellite Katello is a content management component of Red Hat Satellite, a system used by enterprises to manage configurations across their infrastructure. An SQL injection vulnerability in the Registry Proxy feature allows an attacker with minimal permissions (create_personal_access_tokens) to execute arbitrary database queries, potentially exposing sensitive data or compromising system integrity. The flaw requires no additional user interaction and can be exploited even from restricted user accounts with no Organization or Location assignments.

Technologies: Red Hat Satellite. Vendors: Red Hat.

Quick answers

Is CVE-2026-56097 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56097 being exploited in the wild.
How severe is CVE-2026-56097?: Medium severity, with a CVSS score of 6.5, published 1 October 2026.
Which products and versions are affected?: Red Hat Satellite 6.19.5 and earlier.
Is there a fix for CVE-2026-56097?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56097 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56097?: Check whether you run Red Hat Satellite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The RegistryProxiesController methods check_blob_push_org_label and get_matching_products_from_org fail to sanitize user-supplied label parameters from the request path, directly interpolating them into raw SQL fragments. An attacker with the create_personal_access_tokens permission can inject SQL commands through labels to manipulate queries. The vulnerability is accessible over the network with minimal authentication and privilege requirements.

Affected products

Red Hat Satellite 6.19.5 and earlier

Timeline

2026-10-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.