CVE-2026-107445 Red Hat CVE debrief

Who should care

Red Hat Satellite 6 and Red Hat Hardened Images administrators and security teams should assess exposure and prioritize remediation based on organizational risk. These stakeholders need to verify inventory for affected components, review compensating controls, and monitor for potential unauthorized access. They should also track exceptions, retest remediated assets, and ensure evidence is documented before closing the item.

Why it matters

CVE-2026-107445 is a medium-severity vulnerability in the Katello Flatpak Remote Repositories API, potentially allowing cross-organization authorization bypass. Red Hat Satellite 6 and Red Hat Hardened Images deployments may be affected. Administrators should assess exposure, verify inventory, and prioritize remediation based on organizational risk.

• Potential unauthorized access to flatpak remote repository information
• Possible creation of repositories in products with stored remote credentials
• Need for verification of affected versions and remediation
• Potential impact on confidentiality and integrity of repository data

Technical summary

The Katello Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier, potentially allowing authenticated users to access repository information belonging to another organization. This vulnerability could lead to unauthorized access to flatpak remote repository information and possible creation of repositories in products with stored remote credentials. The technical impact is medium severity, with potential effects on confidentiality and integrity of repository data.

Defensive priority

Assess exposure of Red Hat Satellite 6 and Red Hat Hardened Images deployments, verify inventory for affected components, and prioritize remediation based on organizational risk.

Recommended defensive actions

• Assess exposure of Red Hat Satellite 6 and Red Hat Hardened Images deployments
• Verify inventory for affected components
• Prioritize remediation based on organizational risk
• Monitor for potential unauthorized access to flatpak remote repository information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the authorization bypass vulnerability in the Katello Flatpak Remote Repositories API. Evidence is limited to publicly available records, and defenders should verify affected scope and vendor guidance within these constraints. The CVE record and NVD detail do not provide additional information on exploitation or affected versions beyond what is publicly known.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.