EUVD-2026-20515
GHSA-mvqc-wfv6-7764
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable Quay API, low complexity, requires an authenticated push-capable user (PR:L), no user interaction, and deserialization yields full RCE impacting C/I/A.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
AnalysisAI
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deserialization (CWE-502) of resumable container image layer upload state stored in the database. An attacker with the privileges needed to initiate image uploads can tamper with intermediate upload data to execute arbitrary code on the Quay server. No public exploit identified at time of analysis; EPSS is low (0.06%) and CISA SSVC marks exploitation status as none, though technical impact is rated total.
Technical ContextAI
Red Hat Quay is a container image registry, and Mirror Registry for Red Hat OpenShift is a minimal Quay-based registry used to host OpenShift release content in disconnected environments. Affected CPEs cover red_hat_quay_3, mirror_registry_for_red_hat_openshift, and mirror_registry_for_red_hat_openshift_2. The root cause is CWE-502 (Deserialization of Untrusted Data): Quay's resumable layer upload feature persists partial upload state to its backing database in a serialized format that is later rehydrated by the server, so if the stored representation is tampered with, the deserializer can be coerced into instantiating attacker-controlled objects and triggering code execution within the Quay process.
RemediationAI
Patch available per vendor advisory: upgrade Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift to the fixed builds shipped in the Red Hat errata listed for this CVE (RHSA-2026:19375, RHSA-2026:21017, RHSA-2026:22465, RHSA-2026:22629, RHSA-2026:22840, RHSA-2026:23361, RHSA-2026:24833, RHSA-2026:24853, RHSA-2026:28441), selecting the erratum matching your channel; see https://access.redhat.com/security/cve/CVE-2026-32590 and https://bugzilla.redhat.com/show_bug.cgi?id=2446964 for mapping. Until patched, restrict who can push to the registry by tightening repository-creation and push permissions to a minimal set of trusted service accounts, place Quay behind an authenticated ingress that blocks anonymous or low-trust users from reaching the v2 upload endpoints (PATCH/PUT to /v2/<repo>/blobs/uploads/), and monitor the database for unexpected modifications to in-progress upload records; these controls reduce exposure but break workflows that rely on broad self-service push and do not eliminate risk from already-trusted users.
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concur
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization adminis
OpenShift Mirror Registry leaks valid usernames and email addresses through inconsistent error messages during authentic
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today