Authorization Flaw in Katello Flatpak Remote Repositories by Red Hat
CVE-2026-107445

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Red Hat Satellite 6
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107445?

An authorization flaw in Katello's Flatpak Remote Repositories API allows an authenticated user with access to view flatpak remotes within one organization to potentially access sensitive flatpak remote repository information belonging to another organization. This could lead to unauthorized actions such as creating a repository configured with another organization's flatpak remote URL, exploiting stored remote credentials due to improper scoping of access controls.

References

https://access.redhat.com/security/cve/CVE-2026-107445
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2547766
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Aditya Dixit for reporting this issue.
.