Red Hat Quay CVE-2026-102295

Exploitation requires the victim to be an authenticated Quay user with an active session who is lured into clicking an attacker-crafted URL that triggers Quay's OAuth callback handler; the injected script then executes because the callback performs improper input sanitization. Limiting factors: mandatory user interaction (UI:R), the victim must already be logged in for session/registry impact, and the attacker must deliver the malicious link (e.g., via phishing). Impact is confined to the victim's browser session in the Quay application context rather than server-side compromise.

This is a moderate-severity reflected/DOM XSS (CWE-79) in Red Hat Quay 3's OAuth callback handler, scored CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The network vector and low attack complexity favor the attacker, but exploitation is gated by UI:R - a logged-in victim must be tricked into clicking a crafted link - and the impact is bounded to Low confidentiality and Low integrity with no availability effect, consistent with session/token theft and actions in the victim's context rather than full registry compromise. No EPSS score, CISA KEV listing, POC, or SSVC decision data were supplied, so there is no evidence of active exploitation or published exploit code; this appears to be a genuine but not emergency-priority issue. The absence of exploitation-probability signals means prioritization should rest on CVSS and exposure: patch during normal cadence, prioritizing internet-facing Quay instances. No conflicts between the CVSS vector and the description were observed - both agree on remote, user-interaction-dependent, limited-impact client-side execution.

An attacker crafts a malicious link targeting Quay's OAuth callback endpoint with an unsanitized parameter and sends it to an authenticated Quay user (e.g., via phishing). When the logged-in victim opens the link, injected JavaScript runs in the Quay application context, letting the attacker steal the session/OAuth token, read sensitive registry data, or perform actions as the victim. No public exploit code was identified at the time of analysis.