Red Hat Quay CVE-2026-105447

Exploitation requires an account with global read-only administrative privileges on the Quay registry (PR:H) and that the target repositories use build triggers whose configuration contains repository write/delegate tokens - the flaw is the build trigger API returning those delegate tokens to read-only admins. Limiting factors: the attacker must already hold a global read-only admin role (not an ordinary or anonymous user), build triggers must be configured on repositories of interest, and no user interaction is needed. This confines realistic exploitation to malicious insiders or attackers who have already compromised a read-only admin credential rather than unauthenticated external attackers.

This is a moderate-severity authorization flaw (CWE-863) with a vendor-assigned CVSS of 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N). The vector shows network reach and low complexity, but critically requires high privileges (PR:H): the attacker must already be a global read-only administrative user, which substantially narrows the realistic attacker population to insiders or compromised admin accounts rather than anonymous internet attackers. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS probability was provided in the input, so there is no evidence of active or widespread exploitation. The signals are internally consistent - a high-privilege, insider-leaning integrity issue rather than a mass-exploitable remote flaw - so this should be treated as a meaningful but not emergency priority, prioritized where Quay hosts sensitive private repositories and where read-only admin accounts are broadly delegated. Note that the description frames the account as 'read-only,' yet the CVSS integrity impact is High (I:H) because the leaked delegate tokens permit image pushes; this apparent tension is resolved by recognizing the privilege escalation is the core impact and should be verified against Red Hat's advisory.

An authenticated user holding only global read-only administrative privileges on a Quay instance queries the build trigger API endpoint and receives trigger configuration data that improperly includes repository write (delegate) tokens. Using those leaked tokens, the user pushes a tampered or malicious container image into a private repository they should not be able to modify. No public proof-of-concept is known, but the low attack complexity (AC:L) means the request sequence is straightforward once read-only admin access is held.