The vulnerability CVE-2026-4324 affects the Katello plugin within Red Hat Satellite 6.17 for RHEL 9. It is caused by improper neutralization of special elements in the sort_by parameter of the /api/hosts/bootc_images API endpoint, allowing remote attackers to inject arbitrary SQL commands. This can lead to denial of service through database errors and potentially enable Boolean-based blind SQL injection attacks to extract sensitive information. Red Hat has issued security advisories (RHSA-2026:22326 and RHSA-2026:5968) providing patches in Red Hat Satellite versions 6.18.4 and 6.19.1. The advisories recommend applying these updates after all previous errata are applied. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and partial confidentiality and availability impact.

Successful exploitation of this vulnerability can cause denial of service by triggering database errors and may allow attackers to perform Boolean-based blind SQL injection to extract sensitive information from the database. The impact is rated medium severity with partial confidentiality and availability impact. There are no reports of known exploits in the wild at this time.

Red Hat has released official patches addressing this vulnerability in Red Hat Satellite versions 6.18.4 and 6.19.1. Users should apply these updates promptly after ensuring all previously released errata relevant to their systems have been installed. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigation actions are indicated by the vendor advisory.