Red Hat Quay CVE-2026-102576

Exploitation requires two concrete, limiting conditions stated in the advisory: (1) the target Quay deployment must be configured to use direct database authentication (not external identity providers such as OIDC/LDAP/SSO), and (2) the victim must click the attacker's crafted login URL and actively complete authentication through it. The root cause is that Quay does not validate the post-login redirect destination before navigating to it, allowing arbitrary script execution in the victim's authenticated browser context. Realistic risk is bounded by the need for user interaction (UI:R), the high attack complexity (AC:H), and the non-default/specific auth configuration - deployments using external auth providers are not affected, and impact is limited to the victim's own session (S:U, C:L/I:L).

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, base 4.2 Medium) tells a consistent story: although the attack vector is network and no attacker privileges are required (PR:N), exploitation is gated by high attack complexity (AC:H) and mandatory user interaction (UI:R), with only Low confidentiality and Low integrity impact and no availability impact. These signals reinforce rather than conflict with each other - the real-world bar is high because two independent conditions must both hold: the Quay deployment must be configured for direct database authentication, and the victim must actively complete a login through the attacker's crafted URL. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-probability and automation signals are simply absent (not low - unmeasured); absence of these is not evidence of safety but also does not elevate priority. There is no conflict between the CVSS network vector and the description - both agree exploitation is remote but requires victim cooperation and a specific non-default auth mode. Net assessment: a real but narrowly-scoped reflected/DOM XSS that warrants patching on a normal cadence rather than emergency response, unless an environment is known to use direct DB auth and serve high-value sessions.

An attacker crafts a malicious Quay login link containing an unvalidated redirect destination and sends it to a Quay user via phishing. When the victim clicks the link and completes authentication against a Quay instance using direct database authentication, the application navigates to the attacker-controlled destination without validating it, executing arbitrary script in the victim's authenticated session. No public exploit identified at time of analysis, so this scenario is based on the vulnerability description rather than observed exploitation.