Red Hat Quay 3 CVE-2026-6848

Exploitation requires an authenticated user session that is either timed-out on the client side or idle but still valid on the server. The attacker must have network access to the Quay API or web UI and must already possess an authenticated session cookie or token (PR:L in CVSS vector). The vulnerability is triggered when attempting sensitive operations (token generation, robot account creation) that should normally prompt for re-authentication. No user interaction is required from the attacker once the session is accessed. The vulnerability does NOT require default configuration; it affects all Red Hat Quay 3.x deployments. Limiting factors: the attacker cannot exploit this vulnerability against an entirely new, unauthenticated session (PR:N is not granted), so some form of prior session hijacking, session reuse, or physical access to an employee's workstation is required.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates network-accessible exploitation requiring only low privileges (PR:L) with no user interaction, making this practically exploitable in real environments. The moderate CVSS score of 5.4 understates risk in specific deployments: an attacker physically present at or with remote access to an employee's workstation can immediately abuse abandoned authenticated sessions without re-authentication. The vulnerability is particularly dangerous because it defeats a critical security control (re-authentication for sensitive ops), creating a secondary compromise pathway. However, the requirement for an already-authenticated session (PR:L) limits exposure to insider threats or attackers with prior access. EPSS and KEV status are not provided; exploitation likelihood is inferred from the straightforward nature of session-timeout bypass attacks and the common real-world scenario of unattended workstations in containerized environments.

An employee with valid Quay credentials leaves their workstation unlocked during a meeting. An attacker with physical access (or remote access via compromised network) browses to the Quay registry management UI, where the employee's authenticated session remains active. The attacker attempts to generate a new token or create a robot account; instead of being blocked by a password re-verification prompt, the operation succeeds because the re-authentication check is bypassed. The attacker now possesses valid credentials to push malicious container images or access sensitive registry data, compromising the CI/CD pipeline.