CVE-2026-107445 in Hardened Images
Summary
by MITRE • 10/08/2026
A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository information belonging to another organization. The same unscoped lookup is used by the mirror action, which may allow creating a repository in a product the user can edit that is configured with another organization's flatpak remote URL and stored remote credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Katello represents a critical failure in access control mechanisms within its Flatpak Remote Repositories API. Specifically, the system fails to properly enforce authorization checks when retrieving information about a flatpak remote repository based solely on an identifier provided by the user. This flaw allows authenticated users who possess permissions to view flatpak remotes within their own organization to bypass organizational boundaries and retrieve sensitive configuration details belonging to other organizations. The root cause lies in the implementation of the lookup logic, which performs an unscoped database query that does not restrict results to the current tenant or organization context. Consequently, any user with basic read access can enumerate and extract data from remote repositories associated with different tenants, leading to a significant breach of multi-tenancy isolation principles essential for secure SaaS and enterprise deployments.
The operational impact of this vulnerability extends beyond simple information disclosure due to its interaction with the mirror action functionality. The same unscoped lookup mechanism is utilized when mirroring flatpak remotes, which enables an attacker to create or configure a repository within a product they have edit permissions for using remote URLs and stored credentials belonging to another organization. This capability allows malicious actors to potentially exfiltrate sensitive data by forcing the Katello server to fetch content from external repositories controlled by other tenants. Furthermore, it could facilitate supply chain attacks if an attacker configures mirrors to point towards compromised or manipulated upstream sources under the guise of legitimate organizational assets. The exposure includes not only metadata but also stored credentials associated with these remote repositories, which may contain authentication tokens or passwords necessary for accessing private flatpak remotes.
From a classification perspective, this vulnerability aligns directly with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key. The failure to scope database queries by organization ID is a classic example of relying on client-supplied identifiers without validating the requester's permissions against those specific resources. In terms of adversarial tactics, this behavior corresponds to ATT&CK technique T1530 Data from Cloud Storage Object Discovery and potentially T1608 Install Remote Tools if used for persistent access or further exploitation within the infrastructure. The lack of proper scoping means that an attacker can pivot through organizational boundaries, treating distinct tenants as part of a single flat namespace rather than isolated security domains.
Mitigation strategies must focus on enforcing strict multi-tenancy checks at both the application logic and database query levels. Developers should ensure that all API endpoints handling resource lookups by identifier explicitly filter results based on the authenticated user's organization ID or tenant context. Implementing authorization middleware that validates ownership before processing requests is essential to prevent unauthorized access across organizational boundaries. Additionally, auditing existing code for similar unscoped queries in other modules can help identify and remediate related vulnerabilities. For immediate risk reduction, administrators should restrict API access to only those users who absolutely require it and monitor logs for unusual patterns of cross-organization data retrieval until a patch is deployed. Regular security assessments focusing on multi-tenant isolation are recommended to ensure that such authorization flaws do not persist in other parts of the platform.