CVE-2026-56097 is an SQL injection vulnerability in the rubygem-katello component of Red Hat Satellite's Katello Registry Proxy. The vulnerability occurs because the RegistryProxiesController methods check_blob_push_org_label and get_matching_products_from_org directly interpolate user-supplied labels from the request path into raw SQL queries without proper sanitization. This flaw can be exploited by a user possessing only the create_personal_access_tokens permission, even if their access is restricted without any Organization or Location assigned. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, and limited privileges required. Red Hat has released a security advisory (RHSA-2026:74503) providing patches for Red Hat Satellite 6.19 to remediate this issue.

The vulnerability allows an attacker with limited privileges (create_personal_access_tokens permission) to perform SQL injection attacks against the Katello Registry Proxy database. This can lead to unauthorized disclosure of sensitive information (confidentiality impact rated high) without affecting integrity or availability. The flaw does not require UI interaction and can be exploited remotely over the network.

Red Hat has released an official security update (RHSA-2026:74503) for Red Hat Satellite 6.19 that fixes this vulnerability. Users should apply this update promptly to remediate the SQL injection flaw. No additional mitigations are indicated by the vendor advisory. Ensure all previously released errata relevant to your system are applied before updating. Refer to Red Hat's official documentation for update instructions.