CVE-2026-56098

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:74503
https://access.redhat.com/errata/RHSA-2026:74504
https://access.redhat.com/errata/RHSA-2026:74505
https://access.redhat.com/errata/RHSA-2026:74506
https://access.redhat.com/security/cve/CVE-2026-56098
https://bugzilla.redhat.com/show_bug.cgi?id=2490542
http://www.openwall.com/lists/oss-security/2026/10/07/3

Configurations

No configuration.

History

07 Oct 2026, 07:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/07/3 -

02 Oct 2026, 18:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:74505 -

02 Oct 2026, 00:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:74504 - () https://access.redhat.com/errata/RHSA-2026:74506 -

01 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-01 18:17

Updated : 2026-10-07 07:17

NVD link : CVE-2026-56098

Mitre link : CVE-2026-56098

CVE.ORG link : CVE-2026-56098

JSON object : View

Products Affected

No product.

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2026-56098", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56098", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T18:02:50.614551Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.14.0.23-1.el8sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "rubygem-katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.16::el8", "cpe:/a:redhat:satellite:6.16::el9", "cpe:/a:redhat:satellite_capsule:6.16::el8", "cpe:/a:redhat:satellite_capsule:6.16::el9", "cpe:/a:redhat:satellite_utils:6.16::el8", "cpe:/a:redhat:satellite_utils:6.16::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.14.0.23-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "rubygem-katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.17::el9", "cpe:/a:redhat:satellite_capsule:6.17::el9", "cpe:/a:redhat:satellite_utils:6.17::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.16.0.20-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "rubygem-katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.18::el9", "cpe:/a:redhat:satellite_capsule:6.18::el9", "cpe:/a:redhat:satellite_utils:6.18::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.18.0.24-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "rubygem-katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.19::el9", "cpe:/a:redhat:satellite_capsule:6.19::el9", "cpe:/a:redhat:satellite_utils:6.19::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.20.0.11-1.el9sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "rubygem-katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "satellite:el8/rubygem-katello", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-10-01T18:17:19.763", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:74503", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:74504", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:74505", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:74506", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-56098", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490542", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/07/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance."}], "lastModified": "2026-10-07T07:17:01.217", "sourceIdentifier": "secalert@redhat.com"}