EUVD-2026-20513
GHSA-7fjh-cgxv-cjc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Quay registry
-
DeliveryEnumerate or predict victim upload session IDs
-
ExploitSubmit crafted API requests to hijack session
-
ExecutionRead/modify/cancel victim's image upload
-
ImpactExtract sensitive data or inject malicious content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires authenticated access with push privileges to at least one repository on the target Red Hat Quay registry. Attacker must identify or predict active upload sessions from victim users, requiring either timing coordination with victim upload activity or knowledge of session identifier generation patterns. The vulnerability specifically affects the in-progress upload mechanism, so exploitation window exists only during concurrent image push operations. Limits on exploitation include the need for valid registry credentials (PR:L), the transient nature of upload sessions (attack surface exists only during active uploads), and detection risk from audit logs showing cross-repository session access patterns. |
| Impact | CVSS 7.4 (High) with network vector (AV:N), low complexity (AC:L), and changed scope (S:C) indicates significant design-level exposure, but real-world risk signals paint a more nuanced picture. EPSS probability of 0.03% (8th percentile) suggests security researchers and attackers have not prioritized this vulnerability for exploitation. CISA SSVC assessment confirms no known exploitation, non-automatable attack requiring authenticated access and timing coordination with victim uploads, and partial technical impact (read/modify/DoS of upload sessions only, not persistent compromise). The authentication requirement (PR:L) and need to coordinate with active victim uploads creates practical exploitation barriers. Primary risk exists in multi-tenant Quay deployments where untrusted users have push access, particularly in shared registries serving multiple development teams. Single-tenant or tightly controlled registries face lower practical risk despite the high CVSS score. The vulnerability represents a privilege escalation and information disclosure issue rather than full system compromise. |
| Exploit ScenarioDerived | An authenticated developer with push access to a public or low-sensitivity repository waits for legitimate users to begin uploading container images to protected repositories. The attacker enumerates or predicts upload session identifiers and submits crafted API requests to the Quay registry to hijack these sessions. They read partial image layer data to extract sensitive information embedded in container filesystems, modify upload chunks to inject malicious layers into trusted images, or cancel uploads to cause denial of service during critical CI/CD pipeline operations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 28, 2026
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concurrent uploads by other users across the entire registry, enabling unauthorized read, modification, or cancellation of in-progress uploads in repositories they cannot access. This cross-repository attack vector affects Red Hat Quay 3.x and Mirror Registry deployments. EPSS score of 0.03% (8th percentile) indicates low predicted exploitation probability in the wild, and CISA SSVC framework rates this as non-automatable with no known exploitation, suggesting targeted risk rather than widespread threat despite the 7.4 CVSS score.
Earlier versions of this analysis (1)
Red Hat Quay container registry allows authenticated users with push access to interfere with other users' image uploads across repositories, including those they cannot access. An authenticated attacker (PR:L) can read, modify, or cancel in-progress uploads in any repository on the registry, bypassing authorization boundaries. Attack complexity is high (AC:H) and requires user interaction (UI:R), but enables cross-scope integrity compromise. EPSS and KEV data not available; no public exploit identified at time of analysis. This represents an authorization flaw affecting Red Hat Quay 3.x and Mirror Registry deployments.
RemediationAI
Consult Red Hat's official security advisory at https://access.redhat.com/security/cve/CVE-2026-32589 for patched versions and upgrade instructions, as specific fix versions are not confirmed in available analysis data. Monitor Red Hat Bugzilla ticket 2446963 (https://bugzilla.redhat.com/show_bug.cgi?id=2446963) for technical details and patch availability timeline. As compensating controls until patching, restrict repository push access to only trusted authenticated users in multi-tenant Quay deployments, implement network segmentation to limit registry access to authorized build systems rather than broad developer access, and enable comprehensive audit logging to detect anomalous upload session activity patterns (trade-off: increased storage and log analysis overhead). In high-security environments, consider temporary migration to isolated single-tenant Quay instances per development team to eliminate cross-repository attack surface (trade-off: increased operational complexity and infrastructure costs). Review and revoke unnecessary push privileges across all repositories to minimize the pool of potentially malicious authenticated users.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that Red Hat Quay's image upload process uses insufficiently validated user-supplied identifiers to locate or lock upload sessions. The container registry architecture typically manages concurrent blob uploads through session tokens or temporary storage identifiers. The flaw allows an authenticated attacker to manipulate these identifiers to reference upload sessions belonging to other users in different repositories. Affected products per CPE data include Red Hat Quay 3.x (cpe:2.3:a:red_hat:red_hat_quay_3) and Mirror Registry for Red Hat OpenShift versions 1.x and 2.x. The Changed scope (S:C) in the CVSS vector confirms that impact extends beyond the attacker's authorized repository boundaries into other users' security contexts.
Know when Mirror Registry For Red Hat Openshift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
Executive ViewAI
Red Hat Quay container registry allows authenticated users with push privileges to interfere with concurrent image uploads across the entire registry, potentially exposing, modifying, or canceling uploads in repositories they lack access to. This cross-repository privilege escalation affects Quay 3.x and Mirror Registry deployments and could enable insider threats or compromised accounts to disrupt CI/CD pipelines and manipulate container supply chains.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict push privilege grants to minimal required accounts; (2) Implement role-based access control (RBAC) per repository to prevent cross-repository upload interference; (3) Enable audit logging for all push operations and monitor for concurrent upload activity from unexpected sources; (4) Isolate registry traffic to trusted CI/CD infrastructure via network policies; (5) Monitor Red Hat advisories for patch availability and establish upgrade timeline for Quay 4.x.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deser
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct
Server-side request forgery in Red Hat Quay allows an authenticated repository administrator to bypass the hostname blac
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization adminis
OpenShift Mirror Registry leaks valid usernames and email addresses through inconsistent error messages during authentic
Exploit-DB