Quay
CVE-2025-4374
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.
AnalysisAI
A flaw was found in Quay. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-266. A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository. Affected products include: Redhat Quay.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
A privilege escalation flaw was found in Podman. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita
A flaw was found in Keystone. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public explo
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. Rated
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of s
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. Rated high s
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Rated high seve
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. Rated high sev
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potential
A flaw was found in Quay. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenticatio
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. Rated medium se
A flaw was found in the Quay registry. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low
A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is prov
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today