Red Hat Quay CVE-2026-109195

Exploitation requires an authenticated Quay account (PR:L), and two concrete, attacker-satisfiable preconditions stated in the description: the attacker must manage a repository whose name is identical to the target namespace's repository name, AND must already know the target auto-prune policy's unique identifier. The underlying defect is that the policy-details lookup by repository name plus policy identifier does not enforce namespace scoping. Limiting factors that reduce real-world risk: the need for a valid account, the name-collision requirement, the requirement to know a specific policy identifier (reflected as AC:H), and the fact that impact is limited to disclosure of auto-prune configuration details (C:L) with no modification or denial of service. This is primarily relevant to multi-tenant Quay deployments where untrusted users share a registry.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.1 (Low) and the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N tells a coherent story: network-reachable (it is a registry API), but high attack complexity, requiring an already-authenticated, low-privileged account, with only limited confidentiality impact and no integrity or availability impact. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept was supplied - so exploitation status is 'no public exploit identified at time of analysis.' The high attack complexity (AC:H) is well justified by the description: the attacker must both control a repository whose name collides with the target's repository name AND already know the target policy's unique identifier, which is a non-trivial pair of preconditions that cannot simply be brute-forced at will. No SSVC decision data was provided. Net assessment: this is a high-CVSS-correlated-is-actually-low real-risk authorization/IDOR flaw whose impact is confined to disclosure of auto-prune policy configuration metadata, not credentials, images, or code. It is a legitimate defense-in-depth fix for multi-tenant Quay deployments but does not warrant emergency prioritization.

An authenticated low-privileged Quay user who happens to operate a repository whose name matches a victim namespace's repository, and who has learned the unique identifier of a target auto-prune policy, queries the policy-details endpoint and receives the victim namespace's auto-prune configuration back due to missing namespace scoping. No public exploit code is known, and the AV:N/AC:H profile means exploitation is remote but requires the attacker to satisfy the name-collision and known-identifier preconditions first. The disclosed data is configuration metadata (prune rules), not image content or secrets.