The Katello plugin for Red Hat Satellite contains a flaw where the sort_by input of the /api/hosts/bootc_images endpoint is not properly sanitized. This allows an attacker to inject arbitrary SQL commands. The injected statements can trigger database errors, leading to a denial of service, and, on suitable database responses, enable Boolean‑based blind SQL injection that may reveal sensitive data.

Red Hat Satellite 6, including the 6.17 and 6.18 builds for RHEL 9, as well as the satellite capsule, maintenance, and utilities components at those same versions.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog, and no public exploitation has been reported. Based on the description, the likely attack vector is a remote web‑application request to the exposed API endpoint, potentially requiring network access to the Satellite server but not necessarily privileged credentials. An attacker could induce a database error that halts the API or, if database error messages are returned, infer database structure or sensitive data through Boolean‑based blind techniques.