CVE-2026-4324: 
Ruby vulnerability analysis and mitigation

CVE-2026-4324 is a SQL injection vulnerability in the Katello plugin (rubygem-katello) for Red Hat Satellite, caused by improper sanitization of user-provided input in the sort_by parameter of the /api/hosts/bootc_images API endpoint. A remote attacker with low privileges can inject arbitrary SQL commands into the database query's ORDER clause, potentially causing Denial of Service (DoS) or enabling Boolean-based Blind SQL injection to extract sensitive data. The vulnerability was reported on March 17, 2026, and patches were issued on March 26, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the sort_by parameter passed to the /api/hosts/bootc_images API endpoint is not properly sanitized before being incorporated into the database ORDER clause. While the underlying Rails/ActiveRecord framework blocks some complex injection patterns, an attacker can still manipulate the query structure to trigger database errors or conduct Boolean-based Blind SQL injection. Exploitation requires only low-privilege authenticated network access with no user interaction, making it straightforward for any authenticated Satellite user to attempt (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in two primary outcomes: Denial of Service by triggering database errors that disrupt Satellite operations, and information disclosure through Boolean-based Blind SQL injection that allows an attacker to systematically extract sensitive data from the Satellite database — which may include host configurations, credentials, subscription data, and other managed infrastructure details. The confidentiality and availability impacts are both rated Low in the CVSS scoring, reflecting the constrained but real risk of data leakage and service disruption. Integrity is not directly impacted by this vulnerability (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability requires low-privilege authenticated access (any valid Satellite user account), no user interaction, and is network-accessible. The EPSS score is approximately 0.069%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 5009359) and Nessus (IDs: 303904, 303901) (Red Hat CVE, Feedly).

1. Authenticate to Satellite: Obtain any valid low-privilege user account on the Red Hat Satellite instance (e.g., a standard read-only user or content viewer).
2. Identify the vulnerable endpoint: Locate the /api/hosts/bootc_images API endpoint on the target Satellite server.
3. Craft a malicious request: Send an authenticated HTTP GET or POST request to /api/hosts/bootc_images with a crafted sort_by parameter containing SQL injection payloads targeting the ORDER clause, e.g., sort_by=name,(SELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(5)+ELSE+pg_sleep(0)+END)--.
4. Trigger DoS or enumerate data: Use error-based or Boolean-based Blind SQL injection techniques to either trigger database errors (causing DoS) or systematically extract data by observing true/false response differences in the API output.
5. Extract sensitive information: Iteratively query database tables (e.g., users, hosts, subscriptions) using Boolean-based blind techniques to exfiltrate sensitive Satellite data (Red Hat Bugzilla, Red Hat CVE).

• Network: Repeated authenticated API requests to /api/hosts/bootc_images with unusual or encoded sort_by parameter values; high volume of requests to this endpoint from a single user or IP address.
• Logs: Satellite/Foreman production logs showing database errors (e.g., PostgreSQL syntax errors or query failures) correlated with requests to /api/hosts/bootc_images; Rails application logs showing malformed ORDER BY clauses.
• Logs: Unusual patterns of API calls from low-privilege accounts that do not match normal operational behavior, particularly with varying sort_by values in rapid succession (indicative of blind SQL injection enumeration).
• Database: PostgreSQL logs showing repeated query errors or abnormal query structures in ORDER BY clauses originating from the Satellite application (Red Hat Bugzilla).

Red Hat has released patched versions of rubygem-katello addressing this vulnerability across multiple Satellite releases: Satellite 6.17.7 (rubygem-katello-4.16.0.14) via RHSA-2026:5970, Satellite 6.18.4 (rubygem-katello-4.18.0.9) via RHSA-2026:5968, and Satellite 6.19.1 (rubygem-katello-4.20.0.4) via RHSA-2026:22326. Administrators should apply the relevant errata immediately. As interim mitigations, consider implementing WAF rules to detect and block SQL injection attempts against the /api/hosts/bootc_images endpoint, and restrict API access to only authorized and necessary users (RHSA-2026:5970, RHSA-2026:5968, RHSA-2026:22326).