Authorization Bypass Vulnerability in Katello by Red Hat
CVE-2026-56098

4.3MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Satellite 6.16 For Rhel 8; Red Hat Satellite 6.16 For Rhel 9; Red Hat Satellite 6.17 For Rhel 9; Red Hat Satellite 6.18 For Rhel 9
Vendor: CVE Published:; 1 October 2026

What is CVE-2026-56098?

An authorization bypass vulnerability exists in the RegistryProxiesController of Katello, attributed to a flawed execution flow in the registry_authorize filter. This flaw allows unauthorized requests to pass through without proper termination, which leads to the execution of subsequent logic and potential exposure of sensitive database information. An unprivileged attacker can exploit this flaw to enumerate valid Users, Organizations, and Products, thereby revealing critical internal state information through inconsistent response outputs.