Red Hat Quay CVE-2026-109194

Requires an authenticated account that holds administrative access to at least one repository on the same Red Hat Quay instance (PR:L), AND prior knowledge of the victim trigger's universally unique identifier (UUID). Because the UUID is a random, non-enumerable value, the attacker must obtain it out-of-band (logs, leaks, shared references) - this is the primary limiting factor and is reflected in CVSS AC:H. There is no user-interaction requirement (UI:N) and the flaw is reachable over the network API (AV:N). It is not exploitable by fully unauthenticated attackers and does not depend on a non-default configuration; it stems from the build-trigger management API failing to verify that a requested trigger belongs to the specified repository.

This is a moderate-severity authorization flaw (IDOR, CWE-639) in Red Hat Quay, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L, base 6.4) tells a coherent story: network-reachable API, but high attack complexity and low-privilege authentication required. The key risk limiter is AC:H, which reflects that the attacker must know the victim trigger's UUID - a random identifier that is not enumerable or guessable, so this is not a drive-by attack. No EPSS score was supplied, there is no CISA KEV listing, and no public POC was provided, so all three exploitation-probability signals point to low real-world urgency: no public exploit identified at time of analysis. The signals are internally consistent - there is no conflict between a network vector and the authenticated/UUID-dependent reality, because AC:H and PR:L already encode those constraints. The genuine impact is integrity (I:H: an attacker can permanently delete or modify another repository's build triggers) and exposure of associated write tokens (credential leakage), which elevates this above a trivial info-leak. Net assessment: a real but not widespread priority - patch in normal cycles; it is a privilege-boundary bug exploitable by an existing authenticated tenant, not an unauthenticated internet-facing RCE.

A legitimate but malicious (or compromised) user who holds administrative rights over any single repository on a shared Quay instance learns or obtains the UUID of a build trigger belonging to a different tenant's repository. They call the build-trigger management API referencing that UUID, and because the API never validates that the trigger belongs to a repository they control, they can read the trigger's write token, alter it, or permanently delete it. No public exploit code was identified at time of analysis, and the random UUID requirement (CVSS AC:H) makes opportunistic exploitation difficult.